PDF malware analysis — malicious · 4604d068e94facc4

MALICIOUS

PDF

49.6 KB Created: 2020-12-02 22:39:34 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 34622a5db935cd8a925a560e4ec7bc57 SHA-1: 8bdece65d26f04ab18d36f6df5f6b0a6af17967b SHA-256: 4604d068e94facc49145f709e4cf89f744fd8f5e042f62c02ef532059e7c6ec4

64 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF contains embedded URLs and is flagged as a link farm on disposable hosting, suggesting it's designed to redirect users to malicious sites. The ML classifier also identified it as malicious. The document body, though heavily obfuscated, contains references to 'Citrix receiver for windows 10' and 'wkhtmltopdf', indicating a lure to download potentially malicious software.

Machine Learning

Nyx PDF Classifier malicious score 0.7198

Heuristics 3

Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://traffking.ru/aws?utm_term=citrix+receiver++for+windows+10
- https://xusalowaxagus.weebly.com/uploads/1/3/4/4/134481150/takave-likuz-jegibodaxas.pdf
- https://kibodowusi.weebly.com/uploads/1/3/4/5/134588916/sezapiv.pdf
- https://kivuligob.weebly.com/uploads/1/3/0/8/130874143/zuronuvef_bazakulanigipe_bofufuvup_xininideweruve.pdf
- https://rikisuluwujufa.weebly.com/uploads/1/3/1/4/131452938/9660614.pdf
- https://josadezabo.weebly.com/uploads/1/3/4/4/134490641/bd2cabbe19.pdf
- https://kukezedom.weebly.com/uploads/1/3/4/6/134629177/ce8c05a.pdf
- https://wepugimi.weebly.com/uploads/1/3/1/0/131070973/vevumisomus-ditukuwazapom-joveba-begibenura.pdf
- https://rozolabo.weebly.com/uploads/1/3/0/8/130814594/7777132.pdf
- https://uploads.strikinglycdn.com/files/66c78456-b489-4eb2-a987-ad3c90c2f094/film_theory_and_criticism_braudy.pdf
- https://s3.amazonaws.com/wipotegadodorek/19677062027.pdf
- https://s3.amazonaws.com/tumasun/zisakitavenufobit.pdf
- https://s3.amazonaws.com/kopisigapub/kepimap.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.