PDF malware analysis — malicious · ebf5ea940230cbff

MALICIOUS

PDF

17.5 KB Created: 2020-10-28 22:19:10 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 9ab187252dd53f056afcdc5123a18366 SHA-1: 22d07474a04281bc843df2575c268b253335ffdd SHA-256: ebf5ea940230cbffcf12cb600b36e95eb7926253a12f11af36c9859bd0bd2e62

172 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

This PDF document functions as a screenshot lure, presenting itself as an image to entice users into clicking a link. The primary link, 'https://gettraff.ru/strik?keyword=go+math+grade+5+lesson+6.8', is identified as a malicious redirector. The document also contains a large number of external PDF links, characteristic of a link farm, likely for SEO manipulation or to distribute further malicious content.

Machine Learning

Nyx PDF Classifier malicious score 0.9971

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE

PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 17 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://gettraff.ru/strik?keyword=go+math+grade+5+lesson+6.8
- https://nabidojanafo.weebly.com/uploads/1/3/4/4/134455463/wofefosogulujode.pdf
- https://cdn-cms.f-static.net/uploads/4382771/normal_5f92e116973d8.pdf
- https://cdn-cms.f-static.net/uploads/4369768/normal_5f897c04dd87a.pdf
- https://moxitasa.weebly.com/uploads/1/3/1/4/131454719/5ce353c9e.pdf
- https://cdn-cms.f-static.net/uploads/4380076/normal_5f8b62336a50b.pdf
- https://milavigik.weebly.com/uploads/1/3/2/8/132815866/moxisifedijukak.pdf
- https://cdn-cms.f-static.net/uploads/4387810/normal_5f92d981db6f8.pdf
- https://s3.amazonaws.com/tetazino/word_analogy_worksheets.pdf
- https://uploads.strikinglycdn.com/files/1247001e-d608-4768-aaa2-ea8b74bc0a83/95891682015.pdf
- https://s3.amazonaws.com/kavitokolezub/82621715507.pdf
- https://s3.amazonaws.com/gupuso/duvafamanasigo.pdf
- https://uploads.strikinglycdn.com/files/c5cbaabe-3d73-4bc8-a027-f64f3968f203/92847956350.pdf
- https://s3.amazonaws.com/nefagolom/58254546817.pdf
- https://s3.amazonaws.com/henghuili-files/importance_of_job_analysis_in_an_organisation.pdf
- https://s3.amazonaws.com/vufupu/epf_withdrawal_form_19_and_10c.pdf
- https://s3.amazonaws.com/midaguvimabof/63815952015.pdf
- https://s3.amazonaws.com/gupuso/pakif.pdf
- https://uploads.strikinglycdn.com/files/b6b1d9a6-28c2-4c99-9813-26959f7f8168/tewekirezezokefatat.pdf
- https://s3.amazonaws.com/belapawerezuju/blank_bar_graph_for_first_grade.pdf
- https://s3.amazonaws.com/fedufiporara/3263427440.pdf
- https://s3.amazonaws.com/nopomewegobij/business_english_phrases_and_expressions.pdf
- https://s3.amazonaws.com/nefagolom/don_quijote_cervantes_espanol.pdf
- https://uploads.strikinglycdn.com/files/7faa76a1-192d-4353-b664-c082476add14/xoripeb.pdf
- https://uploads.strikinglycdn.com/files/1231dd5d-4ff0-4929-93d3-2440763d7493/sygic_code_dactivation.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.