PDF malware analysis — malicious · d87ded312db6918b

MALICIOUS

PDF

41.3 KB Created: 2020-11-04 15:52:42 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 262e772deceb8fa6a6e7e74751dbfd19 SHA-1: 599d0ea9ec97081eb19f9ced8fc89e160e9daa95 SHA-256: d87ded312db6918b523156c562a0a9521251b2371c229769e51d6845c3dca6e0

92 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF contains a critical heuristic firing indicating a malicious redirector link. The ML classifier also flagged the document with high confidence. The embedded URL points to a known malicious redirector, suggesting an attempt to lure the user to a harmful site, likely for phishing or malware delivery.

Machine Learning

Nyx PDF Classifier malicious score 0.9989

Heuristics 2

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://gettraff.ru/strik?keyword=st+peter+catholic+school+jefferson+city+mo
- https://cdn-cms.f-static.net/uploads/4366031/normal_5f8c625b7904d.pdf
- https://cdn-cms.f-static.net/uploads/4368505/normal_5f8f2b1d921dd.pdf
- https://cdn-cms.f-static.net/uploads/4381082/normal_5f8b4f61e5b03.pdf
- https://cdn-cms.f-static.net/uploads/4443588/normal_5f9d3813a71c2.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://s3.amazonaws.com/jamokaroxoj/janafibijazozix.pdf
- https://s3.amazonaws.com/jamokaroxoj/jarimisakikilifa.pdf
- https://uploads.strikinglycdn.com/files/9993607b-6744-4cd8-9842-77ee15f42dc6/18065062113.pdf
- https://uploads.strikinglycdn.com/files/6e290d9b-5c90-40f2-b027-d0fbc6851bb8/nikotugetasevoke.pdf
- https://s3.amazonaws.com/jadere/budaya_organisasi_terhadap.pdf
- https://s3.amazonaws.com/xurixado/4k_video_downloader_license_key_reddit.pdf
- http://scripts.sil.org/OFL

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00008bed.bin` `30926c7ed06042a7f3f007b9277248146816df2f5608dba06e7074cdb6c34acd`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x8BED	5536 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.