PDF malware analysis — malicious · 44636c90dd731c71

MALICIOUS

PDF

52.2 KB Created: 2020-11-22 22:58:48 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: f7faba03ca7eb60a0c20e084c8fb1995 SHA-1: 5d4a6bb819921e032f8cbce5c5b7e6db71162f04 SHA-256: 44636c90dd731c71bc86e7f45cf903c1f2162852919398ecf543dce9de6bdb84

212 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

This PDF document contains numerous embedded links, with at least one pointing to known malicious redirector infrastructure. The document body, though heavily obfuscated, appears to be a lure related to a "Waze instruction manual". The presence of a link farm and a malicious redirector suggests an attempt to drive traffic to potentially harmful sites, likely for phishing or malware distribution.

Machine Learning

Nyx PDF Classifier malicious score 0.7129

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://traffmen.ru/123?utm_term=waze+instruction+manual
- https://sojofemek.weebly.com/uploads/1/3/4/3/134310133/7855327.pdf
- https://cdn-cms.f-static.net/uploads/4371013/normal_5f8a247fdeb8b.pdf
- https://cdn-cms.f-static.net/uploads/4367964/normal_5f8936ed8f5b4.pdf
- https://pitimonajavigo.weebly.com/uploads/1/3/1/3/131383860/puwexomobevuned.pdf
- https://kepupumi.weebly.com/uploads/1/3/4/6/134616340/31200b201024cc.pdf
- https://mesenogixu.weebly.com/uploads/1/3/4/7/134736765/loloroneg.pdf
- https://notesigul.weebly.com/uploads/1/3/4/6/134689219/topuvetekevosufugi.pdf
- https://uploads.strikinglycdn.com/files/72f6e5bc-a38f-4202-8f18-fa5a9af16867/famous_alumni_of_babson_college.pdf
- https://s3.amazonaws.com/tamobalasu/16959748122.pdf
- https://uploads.strikinglycdn.com/files/52a708e4-e72e-43ae-ab12-9af15867377f/sutavuwinosoruritigo.pdf
- https://uploads.strikinglycdn.com/files/d71de143-ef3e-454b-a3ca-96c1b3d2b1c8/advantages_of_artificial_intelligenc.pdf
- https://uploads.strikinglycdn.com/files/80d527db-e655-4929-9fb7-9dbc0940cb3a/para_comprender_la_historia_juan_bro.pdf
- https://uploads.strikinglycdn.com/files/33d554b3-69f3-4e36-aa81-be2ffbcac32c/ap_lit_essay_a_streetcar_named_desire.pdf
- https://uploads.strikinglycdn.com/files/81d2fc00-0a68-4203-a36f-af01e26f1455/351_winchester_st.pdf
- https://s3.amazonaws.com/dozuga/unblocked_ninja_cat_games.pdf
- https://uploads.strikinglycdn.com/files/cddd26e2-9d45-40b1-8deb-f54145d35703/german_language_grammar_basics.pdf
- https://uploads.strikinglycdn.com/files/fd9c8d47-be8d-4914-a6b3-37ca9385c300/taxoweve.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.