Malicious PDF — malware analysis report

Static analysis result for SHA-256 0d7a21ba4b718bdd…

MALICIOUS

PDF

12.3 KB Created: 2020-10-03 18:00:31 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-25
MD5: 4794c6273d6c5a30ad5570d222443ae9 SHA-1: fe26e2b20032e557c0100e19e43b110fc8b45332 SHA-256: 0d7a21ba4b718bdd181b901dda2e97c7516465bed5d272331bbc1d6e51c42ae4
112 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF document was flagged as malicious by an ML classifier. The file routes users through malicious redirector infrastructure and uses an image-based lure. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9977

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE
    PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 12 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ggtraff.ru/strik?keyword=v5+chicago+by+night+pdf In PDF document text
    • https://site-1036996.mozfiles.com/files/1036996/potebukinazida.pdfIn PDF document text
    • https://site-1038700.mozfiles.com/files/1038700/76793230842.pdfIn PDF document text
    • https://site-1036681.mozfiles.com/files/1036681/89924322384.pdfIn PDF document text
    • https://site-1036818.mozfiles.com/files/1036818/33656872896.pdfIn PDF document text
    • https://site-1036823.mozfiles.com/files/1036823/sulexijusa.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/765286be-3903-4e01-92ff-043dc526d673/ruxezaxiwogun.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4a098238-f155-4ab9-a189-1db9a028ea43/dopobovuni.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/fbec58b7-0df1-41a4-9ca3-b4c0d32ab51f/89665566488.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3bd43951-5a20-4766-86fe-e1ac4a149915/juketopojipebosiwi.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/644474e8-2f12-4848-8ece-57cc83b7f07f/30825224201.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a1e58394-4451-4ac5-9403-aa699bcc6dfb/sozijefibawok.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0483/8067/4197/files/13762657069.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0430/4571/6129/files/pomotemewaIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.