PDF malware analysis — malicious · 0e3c54cade122b20

MALICIOUS

PDF

47.4 KB Created: 2021-01-11 15:27:02 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-06-20

MD5: 40b2517db68455636dc5d181ff318412 SHA-1: a0bd4e619e3afa9379bfee50316b67d64c61ab8a SHA-256: 0e3c54cade122b206ef45cf595f9741248c45b52ffd259d7c40dfc12bcdc38c5

152 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF contains a link to a known malicious redirector, indicating an attempt to phish or deliver malware. The embedded document text, though garbled, suggests a lure related to a 'helper' tool for Chrome. ClamAV also detected this file as a phishing trojan.

Machine Learning

Nyx PDF Classifier malicious score 0.5026

Heuristics 3

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://gettraff.ru/wb?keyword=foe%20helper%202.%204.%206.%202%20chrome In PDF document text
- https://cdn.sqhk.co/tevotapomow/ifijgdH/felarodisu.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4488102/normal_5ff3290381cf3.pdfIn PDF document text
- https://s3.amazonaws.com/rikolesafuwofar/agri_college_in_coimbatore_application_form_2019.pdfIn PDF document text
- https://s3.amazonaws.com/bisute/bb_z10_device_software.pdfIn PDF document text
- https://s3.amazonaws.com/potofaw/grant_cardone_closers_survival_guide_audiobook.pdfIn PDF document text
- https://s3.amazonaws.com/widetunipet/79012606179.pdfIn PDF document text
- https://s3.amazonaws.com/poresi/cesur_ve_gzel_soundtrack.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.