PDF malware analysis — malicious · e6452440dc5ed865

MALICIOUS

PDF

76.4 KB Created: 2020-11-30 12:48:06 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 2be8796ddbb812315baf32c745a76a82 SHA-1: 4a4745c4f07cba2539e46ccd85219f5127139027 SHA-256: e6452440dc5ed86550c71ac6780ce82c3dc3330dfae6d98088130efac2a715a7

182 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.001 User Execution: Malicious Link

The PDF file contains a large number of embedded links, many of which point to link farms and redirectors, indicating a malicious intent to direct users to potentially harmful sites. The ClamAV detection and heuristic firings confirm this file is malicious, likely a phishing or SEO spam document. The embedded URLs are the primary indicators of malicious activity.

Machine Learning

Nyx PDF Classifier clean score 0.2219

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://gettraff.ru/aws?utm_term=dancing+ball+mod+apk+revdl
- https://padomixuboji.weebly.com/uploads/1/3/4/5/134527159/lonugud.pdf
- https://cdn-cms.f-static.net/uploads/4408594/normal_5fbb40e95fd3f.pdf
- https://gunulavosaki.weebly.com/uploads/1/3/4/3/134374607/nedusorowozuko-femek.pdf
- https://lowisaxov.weebly.com/uploads/1/3/4/3/134361609/7c50b5.pdf
- https://lugagixoweliw.weebly.com/uploads/1/3/4/2/134234548/ralev.pdf
- https://mobonojijokatu.weebly.com/uploads/1/3/4/3/134320628/3948886.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbe37ac4f98375720ab6200/1606301612626/antigravity_batteries_xp-10-hd.pdf
- https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbe3ab23c02f22b9dd9025c/1606302386727/zofojasa.pdf
- https://static1.squarespace.com/static/5fbfeb102bbd74065800e14d/t/5fc46c233c6ccf69f3ecc62d/1606708260675/cuantas_constelaciones_hay.pdf
- https://savannah.gnu.org/projects/freefont/
- http://www.gnu.org/licenses/
- http://www.gnu.org/copyleft/gpl.html
- http://scripts.sil.org/OFL

Extracted artifacts 4

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000cca0.bin` `048fb1891f432488516cd811e7b04d68e7d39e548ca3495625137f8fb0c23ff4`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xCCA0	6744 bytes
`font_01_sfnt_off0000dd85.bin` `71e7d79e4a39149d2e45d1c9083439a47d4bfa8941d55a3ba9ec227d888fb104`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xDD85	5476 bytes
`font_02_sfnt_off0000f011.bin` `10a4cabfc4d675d9b69d6b5ede9785cf2283cdcdabebb2c3bb6b025d45b12a63`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF011	4424 bytes
`font_03_sfnt_off000100a4.bin` `06431bf91130cae2449a337b2cb1a2cd01843ea7e21625862d4886d7463b97e1`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x100A4	11168 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.