PDF malware analysis — malicious · f06869b7e2ec8103

MALICIOUS

PDF

32.0 KB Created: 2020-11-09 14:06:00 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: e2b9805e4079bc9cda4b1c4c386e975f SHA-1: 3469f7906d6b02cc4d113d20a824a0224ff49141 SHA-256: f06869b7e2ec8103a6de548a2f8cdef0e452908dedb9c8e29dcb9d68f3fae7d9

152 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded links, many of which point to redirector infrastructure or are part of a link farm designed to manipulate search engine results. The primary URL, https://cctraff.ru/strik?keyword=joseph+mann+++creed+ohio, is flagged as a malicious redirector. The document body, though heavily obfuscated, contains this URL and appears to be a lure related to the search query.

Machine Learning

Nyx PDF Classifier malicious score 0.9988

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://cctraff.ru/strik?keyword=joseph+mann+++creed+ohio
- https://cdn-cms.f-static.net/uploads/4374689/normal_5f92754d86b08.pdf
- https://naxedomabaxa.weebly.com/uploads/1/3/1/6/131606472/3049569.pdf
- https://cdn-cms.f-static.net/uploads/4382771/normal_5f99c2668e9bb.pdf
- https://cdn-cms.f-static.net/uploads/4379482/normal_5fa114797b89d.pdf
- https://cdn-cms.f-static.net/uploads/4413008/normal_5f98a1aa23360.pdf
- https://uploads.strikinglycdn.com/files/bad6d1c8-827b-4380-8fd7-88f18580bd4b/tugobutapina.pdf
- https://uploads.strikinglycdn.com/files/08abe141-2f3f-41d7-8a33-61af4e2c6e62/10964984206.pdf
- https://uploads.strikinglycdn.com/files/81552825-8909-4c8b-bda8-cc391ad73ed6/how_to_start_naoto_social_link.pdf
- https://uploads.strikinglycdn.com/files/62215544-00f3-4041-ad6e-6119e3584071/cch_m_np_ru_vodka.pdf
- https://uploads.strikinglycdn.com/files/54e0532c-b64d-4b56-9c0b-b47eb2c9d2d3/ew36_mobility_scooter_repair_manual.pdf
- https://uploads.strikinglycdn.com/files/556fc74d-49b6-432c-99e7-123e4bb49b63/staar_test_2018_answer_key.pdf
- https://uploads.strikinglycdn.com/files/ecb688d6-fde8-4756-b980-a518dd3dfdc4/jobewubiniwitirix.pdf
- https://uploads.strikinglycdn.com/files/ad5da015-74b5-49a6-a9c4-876809b662fd/delubuxevegatanuwovomive.pdf
- https://uploads.strikinglycdn.com/files/3df1b6b0-54c6-4477-9809-7e59edd35e1b/49848254091.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.