PDF malware analysis — malicious · 47a0810e3807310d

MALICIOUS

PDF

50.6 KB Created: 2020-11-29 10:18:49 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 4fdc38ab98fc11ecfe9a2a68f4cf373c SHA-1: 663a160ed741b95127935d8316b8391f2d7f2d2b SHA-256: 47a0810e3807310dee79c1fd7fcaf94391a263397e976068e356aa977652de1a

152 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a critical heuristic firing for a malicious redirector link pointing to 'https://gettraff.ru/aws?utm_term=oxfam+and+development+finance+international+report+2018'. This indicates the document's primary purpose is to lure users to this malicious URL. While no scripts were extracted, the presence of a malicious redirector and the ML classifier's high confidence score strongly suggest a phishing or malware distribution attempt.

Machine Learning

Nyx PDF Classifier malicious score 0.9725

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://gettraff.ru/aws?utm_term=oxfam+and+development+finance+international+report+2018
- https://cdn-cms.f-static.net/uploads/4365560/normal_5f896a9d155e4.pdf
- https://cdn-cms.f-static.net/uploads/4451949/normal_5fb5d5847f4dc.pdf
- https://cdn-cms.f-static.net/uploads/4451033/normal_5fad86314017c.pdf
- https://s3.amazonaws.com/tobaziw/67117790893.pdf
- https://s3.amazonaws.com/mewezekilafef/3d_and_2d_shapes_worksheets_free.pdf
- https://s3.amazonaws.com/napoledunadigo/wumuponesarabez.pdf
- https://s3.amazonaws.com/ronenitevodo/dell_dimension_2350_manual.pdf
- https://uploads.strikinglycdn.com/files/af016128-4eed-45ce-95b7-cc1a193ed39a/nelajorisamol.pdf
- https://s3.amazonaws.com/kewakuko/iptv_player_apk.pdf
- https://s3.amazonaws.com/lolijexejomak/brocade_fabric_os_8._2_administration_guide.pdf
- https://s3.amazonaws.com/dowavelaxam/zygor_leveling_guide_torrent.pdf
- https://s3.amazonaws.com/novifamigot/gevexuzosowodirezepit.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.