Malicious PDF — malware analysis report

Static analysis result for SHA-256 45bc6dd9ca261db2…

MALICIOUS

PDF

53.5 KB Created: 2020-12-23 06:40:26 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-15
MD5: 9c10c10f87ac4bebe95fa6207a342cfa SHA-1: 6415ca431f73ca3769dd07b91b38fb60d414e64f SHA-256: 45bc6dd9ca261db2d14e50b62d6fc09f0a0f9b8a4381ffaa448de6083f713166
212 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains embedded links, one of which points to a known malicious redirector infrastructure associated with phishing lures. The document body, though heavily obfuscated, contains text fragments suggesting a financial scam related to 'Revolut business bounce back loan'. The presence of numerous external links, including a link farm, further indicates malicious intent to redirect users to potentially harmful sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.6272

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ggtraff.ru/strik?utm_term=revolut+business+bounce+back+loan In PDF document text
    • https://vuxozajuje.weebly.com/uploads/1/3/1/3/131379873/rezareludufiven-voxodopi.pdfIn PDF document text
    • https://lawaxiwutaf.weebly.com/uploads/1/3/4/3/134356413/8235242.pdfIn PDF document text
    • https://xipurewaxo.weebly.com/uploads/1/3/4/7/134759043/rifolera.pdfIn PDF document text
    • https://toriradusug.weebly.com/uploads/1/3/4/7/134744904/sotatapunudon.pdfIn PDF document text
    • https://sibomimotilelib.weebly.com/uploads/1/3/4/2/134235458/noremogovili.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbd0450edabee7b440847b9/1606222928507/barr_nunn_trucking_terminals.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc0de9c5bcb0228a2825217/t/5fc2653d08845d0924d76eb8/1606575422584/rogue_trader_rpg_character_classes.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fce2910de434d6c8f057b39/t/5fd605d5de5b1220c020bedc/1607861717456/55160306221.pdfIn PDF document text
    • https://s3.amazonaws.com/vidadaviwal/nunuf.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fdc9da7ff99f865bfec24a0/t/5fdd21b453f07353dd52ae49/1608327609753/pevamozeliwipepose.pdfIn PDF document text
    • https://s3.amazonaws.com/rizezobabub/getokemivevomerikiwamafup.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fdc9bbe50f46d6500014148/t/5fdd1a17f6bd681e33f8057c/1608325656138/juxanubekudukuzaxodu.pdfIn PDF document text
    • https://s3.amazonaws.com/nagev/mantrap_lake_mn_fishing_report.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc5c2fbea4a794d56668ff8/t/5fd6855a154d727871f12485/1607894362455/wisazilun.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.