PDF malware analysis — malicious · 302d7b49a66eb5c7

MALICIOUS

PDF

58.2 KB Created: 2021-04-22 01:01:13 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: d86a8d421b1e6c62b252ca1571741007 SHA-1: d762499d252fcc55204ab3eb0e9280da3936a419 SHA-256: 302d7b49a66eb5c793463bdc67ac844f4d8e509e3ea168d121715600aab4e0d2

182 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

This PDF document contains a link to a known malicious redirector, yafferge.ru, which is likely intended to phish users or deliver a second-stage payload. The ML classifier and ClamAV detection strongly indicate malicious intent. Although no scripts were extracted, the presence of a malicious URL and the document's structure suggest a phishing or malware delivery attempt.

Machine Learning

Nyx PDF Classifier malicious score 0.9519

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://yafferge.ru/strik?utm_term=lg+v20+battery+kit+walmart
- https://kekufakaxuw.weebly.com/uploads/1/3/2/7/132740700/ruxiwo_rapunaxarakeg_nedigazim.pdf
- http://voirly.xyz/tales_from_the_odyssey_part_2_summarypzsen.pdf
- https://kikitepolo.weebly.com/uploads/1/3/4/5/134514310/5768275.pdf
- http://instapriz365.site/is_forex_easy_to_learnwsqa9.pdf
- http://arenda-comp.space/85266990892efpq7.pdf
- https://cdn-cms.f-static.net/uploads/4387406/normal_5fd3beec89b8f.pdf
- https://static.s123-cdn-static.com/uploads/4382974/normal_5ff9898f14076.pdf
- http://webcam-model.online/what_is_heightened_sense_of_touch2wc04.pdf
- http://opros.xyz/how_to_get_rid_of_spotted_lanternfly_eggsx5llc.pdf
- https://babaketejo.weebly.com/uploads/1/3/5/3/135304919/5252038.pdf
- https://cdn-cms.f-static.net/uploads/4390071/normal_603569a4b2674.pdf
- https://s3.amazonaws.com/veraxawewib/kupatexese.pdf
- https://s3.amazonaws.com/gomakobez/pimumudajofojomuzinap.pdf
- https://s3.amazonaws.com/vaxebisapesi/resize_mac_online.pdf
- https://e6b56e3c-1b88-4cfb-972d-ab1702b0a06e.filesusr.com/ugd/8c0e65_290aaa947c0c4fbaabad71f4f8c131d6.pdf?index=true
- https://8641c524-1fb5-4292-87ed-dd72f64d6c22.filesusr.com/ugd/9b7d8a_91ab7250c221433ba74dff8cc833a421.pdf?index=true
- https://s3.amazonaws.com/rekorewexidiwo/ledojudogijova.pdf
- https://677e6977-fc43-48b2-ac81-16e478c8573b.filesusr.com/ugd/3750c2_794943c0add741be90a3b780156b5090.pdf?index=true
- https://8eefcaf3-52f5-4123-8be5-b1f0aaeea45e.filesusr.com/ugd/1d3654_717b2362d3a34d3eb746944af9508d52.pdf?index=true
- https://s3.amazonaws.com/satedafadusizo/45866326013.pdf
- https://0dd0cd87-80d3-4eb5-b9c6-73c43c3a6fca.filesusr.com/ugd/f0b6b3_8da10c10ea4b41a2bf2293c3c88793c4.pdf?index=true

Open this report in the interactive analyzer, or submit your own file for analysis.