PDF malware analysis — malicious · e0e92e943812bafe

MALICIOUS

PDF

50.6 KB Created: 2020-12-10 13:54:51 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 1b387ba49751318f83d0468359db7cf0 SHA-1: 9f57c6498829f7b444d084588b6a1427dba636d0 SHA-256: e0e92e943812bafedf8f6094ba5ae2aaa0ec366ce1e85e5a0cb0b184a4600c98

152 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a critical heuristic firing indicating it links to known malicious redirector infrastructure. The embedded URL https://cctraff.ru/aws?utm_term=gartner+studios+template+not+working is the primary indicator of malicious intent. While no scripts were explicitly extracted, the PDF structure and the malicious URL suggest an attempt to lure the user to a harmful site, aligning with phishing or malware delivery tactics.

Machine Learning

Nyx PDF Classifier malicious score 0.8920

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://cctraff.ru/aws?utm_term=gartner+studios+template+not+working
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://uploads.strikinglycdn.com/files/7e20b878-38c1-4917-9040-870957b57133/1439352446.pdf
- https://static1.squarespace.com/static/5fc5bc7ddf132613bbdeaa48/t/5fd151eb2c7e2d2d0fab6499/1607553516191/unlimited_car_driving_simulator_mod_apk_rexdl.pdf
- https://uploads.strikinglycdn.com/files/2b73a23d-8a79-4854-8f03-71368cef6949/conveyor_belt_powerpoint_template.pdf
- https://s3.amazonaws.com/kigavanus/fulal.pdf
- https://static1.squarespace.com/static/5fc1cdd0ec917750a3de3367/t/5fc280eff3de5e49b5b57f1e/1606582512427/spider_man_3_pc.pdf
- https://s3.amazonaws.com/vawoginele/university_of_washington_anticoagulation_reversal_guidelines.pdf
- https://s3.amazonaws.com/rirusozo/87058526875.pdf
- https://s3.amazonaws.com/nodetuxapabara/30_day_onboarding_plan_template.pdf
- https://s3.amazonaws.com/sinadi/85663269127.pdf
- https://uploads.strikinglycdn.com/files/c98de1ea-8d08-43b0-bacd-df8ffac8daf8/13609434103.pdf
- https://s3.amazonaws.com/bejexe/73800466539.pdf
- http://scripts.sil.org/OFL

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000b8a9.bin` `b545e52d56497c9969e3c77ed5d125eab216c6e98f42832b6a96ba96328ad290`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xB8A9	5348 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.