PDF malware analysis — malicious · fbecf669324797c6

MALICIOUS

PDF

35.6 KB Created: 2020-11-04 01:58:40 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 3ea003ddf866a64734d5f3ac3ca80538 SHA-1: 6b29d1d8d600b918c380eca9883c9f3c1ecdfc92 SHA-256: fbecf669324797c6bffe5cfd3c248f0df9d9f5b3c3519e814f1aa55a5edf8435

112 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF is identified as an image-only document designed as a lure, containing a clickable link that redirects to known malicious infrastructure. The primary URL, https://cctraff.ru/aws?keyword=farewell+speech+for+students, is flagged as a malicious redirector, indicating the document's intent to lead the user to a harmful destination. The ML classifier also strongly flagged this PDF as malicious.

Machine Learning

Nyx PDF Classifier malicious score 0.9962

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE

PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 35 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://cctraff.ru/aws?keyword=farewell+speech+for+students
- https://naroxelilokatud.weebly.com/uploads/1/3/1/3/131384214/varopazewewijaki.pdf
- https://cdn-cms.f-static.net/uploads/4374963/normal_5f99af035de8c.pdf
- https://dutitujazekap.weebly.com/uploads/1/3/0/8/130814390/delelides_dasexurekiwar_jajumab.pdf
- https://nawitesusamu.weebly.com/uploads/1/3/4/4/134480899/fanulure-rodatajagemine.pdf
- https://gugewixurot.weebly.com/uploads/1/3/4/3/134393699/5490835.pdf
- https://kuvofexe.weebly.com/uploads/1/3/1/1/131163751/00b479029c67f.pdf
- https://gazesomudari.weebly.com/uploads/1/3/1/0/131070071/xupomorusokawowu.pdf
- https://guwomenod.weebly.com/uploads/1/3/0/8/130873843/ratot_muweliwamopoj.pdf
- https://bawuzuxagoju.weebly.com/uploads/1/3/4/3/134340420/067de6500ad6ab.pdf
- https://uploads.strikinglycdn.com/files/d124bd0f-7c57-4c07-a3df-7ec3e9cbc434/zetizewo.pdf
- https://uploads.strikinglycdn.com/files/ea26730a-5b44-4a41-9c91-724840c79067/shokugeki_no_souma__san_no_sara.pdf
- https://uploads.strikinglycdn.com/files/93dced5d-9ef1-4985-b326-0e71efba1ec4/xozab.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.