PDF malware analysis — malicious · f29c270678913ec9

MALICIOUS

PDF

58.3 KB Created: 2020-12-17 20:44:17 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 5a2a8d0cd98dd49cca70208eef6b426a SHA-1: 8f082d587951235d1265e59299dbb3d07abf7c26 SHA-256: f29c270678913ec9b84d8996332e37e2c3a51cdb196cadd3a80a7e6b03a52308

212 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a link to a known malicious redirector, ggtraff.ru, disguised with a search query related to "Husky wet tile saw replacement parts". This indicates a phishing or malware distribution attempt. The PDF also contains a large number of external links, suggesting it's part of a link farm designed to improve search engine ranking for malicious content. ClamAV also detected this file as a phishing trojan.

Machine Learning

Nyx PDF Classifier malicious score 0.9856

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ggtraff.ru/strik?utm_term=husky+wet+tile+saw+replacement+parts
- https://revugegan.weebly.com/uploads/1/3/4/6/134682990/0bf015836ce5989.pdf
- https://cdn-cms.f-static.net/uploads/4483624/normal_5fdb8b808da42.pdf
- https://cdn-cms.f-static.net/uploads/4375209/normal_5fa19cd632242.pdf
- https://miletotafog.weebly.com/uploads/1/3/4/7/134758503/relejivarew-judetojeravisex-lukab.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://s3.amazonaws.com/pivetuzadujo/83014135424.pdf
- https://s3.amazonaws.com/tevomenil/digital_history_chapter_2_the_philippines_answers.pdf
- https://s3.amazonaws.com/jaxesabi/18506972110.pdf
- https://s3.amazonaws.com/zunaduxa/abdominal_aortic_aneurysm_repair_guidelines.pdf
- https://s3.amazonaws.com/vedexajawo/baidunetdisk_english_apk.pdf
- https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbf48f94e98326c02068af7/1606371577903/nogimovavawomelo.pdf
- https://s3.amazonaws.com/liluvad/zigepilu.pdf
- https://s3.amazonaws.com/sifawekujiki/43965774821.pdf
- https://s3.amazonaws.com/wizidimawag/pathfinder_balor_names.pdf
- https://s3.amazonaws.com/naxozelozude/dhol_mandar_baje_re_song.pdf
- http://scripts.sil.org/OFL

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000befd.bin` `0e08fe333a9b1c4f31a76dcb49bf4ba8acdc20084d72d2591fe2bdf3a5e38124`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xBEFD	5072 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.