PDF malware analysis — malicious · d59d6729f12af367

MALICIOUS

PDF

24.6 KB Created: 2020-10-22 23:00:54 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 42c74d540506fd01b058a258ea8f8c3c SHA-1: c83f31687a8eddd8c8906493ea773df4003bf2f4 SHA-256: d59d6729f12af367bd240f8b71c550b2ea189e19279a1f75fc54e322c76af646

172 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

This PDF document is designed as an image-based lure, presenting a screenshot to deceive users. It contains numerous external links, with a critical finding being a link to known malicious redirector infrastructure at `https://gettraff.ru/aws?keyword=performance+appraisal+comments+sample+pdf`. The document also hosts a link farm of other PDFs, suggesting a coordinated effort to distribute malicious content or manipulate search engine results. The ML classifier strongly indicates maliciousness.

Machine Learning

Nyx PDF Classifier malicious score 0.9977

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE

PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 24 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://gettraff.ru/aws?keyword=performance+appraisal+comments+sample+pdf
- https://cdn-cms.f-static.net/uploads/4382193/normal_5f8c8593d3e26.pdf
- https://cdn-cms.f-static.net/uploads/4366007/normal_5f8c239b66d2d.pdf
- https://cdn-cms.f-static.net/uploads/4371508/normal_5f88e03839412.pdf
- https://cdn-cms.f-static.net/uploads/4370057/normal_5f87f6cc6bb40.pdf
- https://bilewazivabo.weebly.com/uploads/1/3/2/8/132816117/0fd84481.pdf
- https://kubupukadumu.weebly.com/uploads/1/3/1/3/131382740/loxutasevi.pdf
- https://pitimonajavigo.weebly.com/uploads/1/3/1/3/131383860/8b715c518b8.pdf
- https://xilorufanil.weebly.com/uploads/1/3/0/7/130739938/xisabit_monojesuf_fibel_piwubuv.pdf
- https://cdn.shopify.com/s/files/1/0437/1605/1096/files/android_circle_progress_bar_programmatically.pdf
- https://cdn.shopify.com/s/files/1/0485/0676/5473/files/lincoln_logs_cabin_instructions.pdf
- https://cdn.shopify.com/s/files/1/0498/6414/7133/files/revell_f-14d_super_tomcat_instructions.pdf
- https://cdn.shopify.com/s/files/1/0437/3551/5290/files/your_freedom_apk_configuration.pdf
- https://cdn.shopify.com/s/files/1/0428/2790/7239/files/clumsy_ninja_apk_free_download.pdf
- https://uploads.strikinglycdn.com/files/3e4d86c8-9eb7-4bda-b5c9-65cceef17b69/3881841724.pdf
- https://uploads.strikinglycdn.com/files/e40b1c5c-8770-42ba-8402-648ed65d6c10/5359373916.pdf
- https://uploads.strikinglycdn.com/files/a709f271-9d48-419c-8f67-9d56e819ba06/simivusuraru.pdf
- https://s3.amazonaws.com/jamokaroxoj/six_pack_workout_routine_at_home.pdf
- https://s3.amazonaws.com/wonoti/viwatoza.pdf
- https://s3.amazonaws.com/susopuzupure/mulapiwivivoroxal.pdf
- https://s3.amazonaws.com/sugaguxagu/kofus.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.