Malicious PDF — malware analysis report

Static analysis result for SHA-256 39161fd275dd557d…

MALICIOUS

PDF

16.6 KB Created: 2020-09-29 20:54:53 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-02
MD5: db3c192b3e28230bac11527ac3416326 SHA-1: 4292934b959f51612631708a9b6a61785398a985 SHA-256: 39161fd275dd557d6c300a2a561dde0ac099562f81c4ebc00b4f43ba5ca303c2
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a link to a known malicious redirector, indicating an attempt to lure the user to a harmful site. The ML classifier also flagged this PDF with high confidence. While no scripts were explicitly extracted, the PDF structure and embedded links suggest a phishing or malware delivery attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9981

Heuristics 2

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://gettraff.ru/strik?keyword=arboles+de+decision+y+electra+1+pdf In PDF document text
    • http://putifasi.elissakatz.com/uploads/1/3/1/4/131408024/vevejimoboxoni-sabavisuzoxu-gajadafererev-visagozilum.pdfIn PDF document text
    • http://files.bleetart.com.au/uploads/1/3/1/3/131382808/giwor.pdfIn PDF document text
    • http://gabozosus.theluxuryboudoir.com/uploads/1/3/1/6/131637881/90304289990.pdfIn PDF document text
    • http://sugexez.openthedoorleadership.com/uploads/1/3/1/4/131453558/dadixexoxovore_zezax_zigitetob.pdfIn PDF document text
    • http://golen.milehightransport.com/uploads/1/3/2/7/132740281/xosedodasumorulukuki.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0432/2312/2077/files/anamika_academy_gandhinagar_material.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0427/6954/7431/files/planet_fitness_marketing_linkedin.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0434/7320/7446/files/sirimalasaromege.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/467ee7ff-98ad-4693-b776-6e514abfe76a/64900724723.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/db8dba7b-a7b3-433f-8d5d-e2aa743d1f03/mujimojepesisuvimejazelo.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/053bbedb-f10c-49bf-ab45-9c688520edff/55024921058.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/41980033-0318-4b2a-954a-b6cd5809eb85/7042872094.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/950ba1b2-cdd9-4436-b5e9-76835ecbb59e/33792102549.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/66753cda-bba5-4c41-b384-1f985e7975ff/tomofopuwekom.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.