PDF malware analysis — malicious · 29391d32d40f99e1

MALICIOUS

PDF

67.6 KB Created: 2021-01-16 11:56:58 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-07

MD5: ecc69b00002e7406c8348e3dc7baec55 SHA-1: ea0b1dd3abb3a4d4a973128ae4688e06389b52af SHA-256: 29391d32d40f99e1cbe6a277b819b07237c9b82badeeac2ec1d85fd6faca7331

152 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF contains a link to a known malicious redirector, indicating an attempt to lead the user to a malicious site. The ML classifier and ClamAV detection further support its malicious nature. The document body, though heavily obfuscated, suggests a lure related to 'rental agreement format in word', which is likely a pretext for phishing or malware delivery.

Machine Learning

Nyx PDF Classifier malicious score 0.8111

Heuristics 3

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://traffine.ru/aws?utm_term=rental+agreement+format+in+word In PDF document text
- https://bixowupe.weebly.com/uploads/1/3/1/4/131409305/60c1145afa.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4462974/normal_5fa4a4333336b.pdfIn PDF document text
- https://site-1178040.mozfiles.com/files/1178040/68386286340.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4379385/normal_5f9e401ba551e.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4489251/normal_5ff7813daccd7.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4378604/normal_5ffe8563a5c23.pdfIn PDF document text
- https://site-1171628.mozfiles.com/files/1171628/67937568474.pdfIn PDF document text
- https://s3.amazonaws.com/dakebesuvum/may_2018_calendar_excel_sheet.pdfIn PDF document text
- https://s3.amazonaws.com/zizene/arpansa_nuclear_medicine_guidelines.pdfIn PDF document text
- https://s3.amazonaws.com/felasorarabipis/tufigerererewexizi.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.