PDF malware analysis — malicious · cff45bde03032a0c

MALICIOUS

PDF

35.6 KB Created: 2020-11-05 13:41:50 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 6b678f2e3cbb7b8e25a97b8a3b02b201 SHA-1: 827d6a499255d3378e73a7dae51d642f74a57661 SHA-256: cff45bde03032a0c73312697fc4a3a26abf2c2f97913ae3002ffc79762686c62

152 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded links, many of which point to redirector infrastructure or are part of a link farm. One prominent link directs to 'https://gettraff.ru/strik?keyword=rooting+apk+for+android', suggesting a lure related to Android rooting applications. The heuristic 'PDF_SEO_LINK_FARM' indicates a mass of external links, further supporting the idea of a link farm used for SEO manipulation or distributing malicious content. The ML classifier also strongly flagged this PDF as malicious.

Machine Learning

Nyx PDF Classifier malicious score 0.9941

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://gettraff.ru/strik?keyword=rooting+apk+for+android
- https://vodipewelo.weebly.com/uploads/1/3/1/6/131637384/xuturixitujip-feluxobalodize-pewagelujulu.pdf
- https://cdn-cms.f-static.net/uploads/4378599/normal_5f8c7f3bbe06b.pdf
- https://cdn-cms.f-static.net/uploads/4374372/normal_5f91e880a40ed.pdf
- https://cdn-cms.f-static.net/uploads/4369654/normal_5f89826a258e4.pdf
- https://cdn-cms.f-static.net/uploads/4383801/normal_5f9253e294571.pdf
- https://uploads.strikinglycdn.com/files/4b61a2ca-ded5-49f4-8b5f-9d07b854f586/juvidusetoguduwatefi.pdf
- https://s3.amazonaws.com/pazaxazusa/rage_games_unblocked.pdf
- https://s3.amazonaws.com/fasanag/53876330640.pdf
- https://uploads.strikinglycdn.com/files/05053822-94ed-4e13-a085-1892478cb0c8/85723462619.pdf
- https://s3.amazonaws.com/loxopudizus/catalogo_price_shoes_importados_2019_con_precios.pdf
- https://s3.amazonaws.com/punagilelabon/45_hours_online_dcf.pdf
- https://s3.amazonaws.com/sikuva/pupomebafobisit.pdf
- https://s3.amazonaws.com/potamotaz/88193595312.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.