PDF malware analysis — malicious · ff337ad98b918f97

MALICIOUS

PDF

16.0 KB Created: 2020-11-07 10:07:07 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: c9f9cc7ed6ef48c744b996bf59e7acec SHA-1: 676a489e3606b3f005a6232bec04ea8fe2e0bbbc SHA-256: ff337ad98b918f97b31e7ee0e95d0d8f11c29de9cd072a452c65e0767460bcc3

114 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF is identified as an image-only lure, typical for phishing campaigns. It contains a clickable external URI that leads to a URL associated with 'multiplying rational numbers worksheet answer', suggesting a deceptive pretext. The PDF also hosts a large number of external links, many pointing to other PDFs, indicating a link farm designed to distribute malicious content or improve SEO for malicious sites. The ML classifier strongly flags this PDF as malicious.

Machine Learning

Nyx PDF Classifier malicious score 0.9981

Heuristics 4

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE

PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 16 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://trafftec.ru/123?keyword=multiplying+rational+numbers+worksheet+answer
- https://finijuzado.weebly.com/uploads/1/3/4/4/134444754/4313310.pdf
- https://uploads.strikinglycdn.com/files/ccabf213-d352-4309-bd9f-655be770e5f5/viratixedaxomiguvabe.pdf
- https://uploads.strikinglycdn.com/files/5f726a0f-3edd-44e9-8de2-a42ee50bf0f4/19856270775.pdf
- https://uploads.strikinglycdn.com/files/75ff1f80-4573-4c48-9a3e-6a49152cfae7/jean_luc_marion_descartes.pdf
- https://uploads.strikinglycdn.com/files/452c0484-f9d8-4d11-92d5-49bc5126d9c9/11892356510.pdf
- https://uploads.strikinglycdn.com/files/a8fe0763-d759-4f6b-aa27-6de744ee4282/7737764442.pdf
- https://uploads.strikinglycdn.com/files/b11ca1c1-e44a-4638-9b0c-d74483215546/yudkin_romantic_period.pdf
- https://wotenopofe.files.wordpress.com/2020/11/budixaw.pdf
- https://uploads.strikinglycdn.com/files/464777af-3824-4b80-b366-bcf0b49710db/71739159305.pdf
- https://kebupud.files.wordpress.com/2020/11/16674380217.pdf
- https://s3.amazonaws.com/jezaxojipevu/tezofatefetetuguporesugo.pdf
- https://uploads.strikinglycdn.com/files/68e3874d-9fe7-4eb7-8f4b-85c407a5be52/36023312691.pdf
- https://vabavoresadi.files.wordpress.com/2020/11/debewasomogoro.pdf
- https://uploads.strikinglycdn.com/files/0ab1fa5f-7f73-4c21-8e84-c7be40f96f15/sultan_ldrmek_nzhetin_katili_kim.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.