PDF malware analysis — malicious · cdc9313740f875be

MALICIOUS

PDF

32.6 KB Created: 2020-11-01 07:37:05 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: bdb96ebb1766808d3bffea37f41b1dfb SHA-1: 86cad846973d80b2a69e42a6f216aff732b758ba SHA-256: cdc9313740f875be45b1cdccc48365ca94da9123f191863a541e3f63f2294be3

92 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The file is a PDF containing a malicious redirector link to 'ggtraff.ru'. This link is likely used to deliver a second-stage payload or phish for credentials. The ML classifier also flagged this PDF with high confidence.

Machine Learning

Nyx PDF Classifier malicious score 0.9996

Heuristics 2

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ggtraff.ru/aws?keyword=renegades+book+3+preview
- https://cdn-cms.f-static.net/uploads/4373304/normal_5f8d0f9675e06.pdf
- https://safasisi.weebly.com/uploads/1/3/4/4/134472516/xefobiputokafuw-zivetifivebe.pdf
- https://jovofodofipepij.weebly.com/uploads/1/3/2/6/132682866/317855.pdf
- https://cdn-cms.f-static.net/uploads/4366376/normal_5f8741384cd16.pdf
- https://cdn-cms.f-static.net/uploads/4370268/normal_5f8a2f1ad55d6.pdf
- https://cdn-cms.f-static.net/uploads/4367646/normal_5f906234e40da.pdf
- https://cdn-cms.f-static.net/uploads/4388165/normal_5f92a8b775465.pdf
- https://cdn.shopify.com/s/files/1/0268/7339/7448/files/chrome_pick_color_from.pdf
- https://cdn.shopify.com/s/files/1/0505/5050/5655/files/siginibebefifitapek.pdf
- https://uploads.strikinglycdn.com/files/1322f57d-3072-4d56-b9c6-2875ad8ca754/pusiluvugalozimis.pdf
- https://uploads.strikinglycdn.com/files/737897f5-efd8-47b6-a264-160d5b50f7f0/dolejelobaxamexek.pdf
- https://uploads.strikinglycdn.com/files/c58df060-fb24-4405-9d14-ac6837560f6c/3d_archicad_libre.pdf
- https://uploads.strikinglycdn.com/files/f2bfe037-5f74-4d9b-bc20-4ccc239f4445/20597361043.pdf
- https://uploads.strikinglycdn.com/files/d4c28bea-9d53-4f53-8629-9b56ca983146/30377543435.pdf
- https://uploads.strikinglycdn.com/files/0e461bbf-301a-420b-b474-d8793634cd9d/spot_bot_pet.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.