PDF malware analysis — malicious · 4d44baf16b77832f

MALICIOUS

PDF

50.6 KB Created: 2020-12-22 02:42:13 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 14bdc48f2ad4c39924d20b2688b58f00 SHA-1: 6ecaac3deac2e4833a3b7d86eed5fd3fede054a0 SHA-256: 4d44baf16b77832fa98ab92cb20f17de37fb52b7664f67c622fc849118d070d5

212 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The sample is a PDF file flagged by multiple heuristics as malicious, including a redirector link and a link farm. The embedded URL points to a known malicious redirector, indicating an attempt to lead the user to a phishing or malware distribution site. The ML classifier also strongly suggests maliciousness.

Machine Learning

Nyx PDF Classifier malicious score 0.7180

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://gettraff.ru/strik?utm_term=can+you+escape+50+rooms+2+level+11
- https://funogumoduwe.weebly.com/uploads/1/3/4/3/134309977/e0df06f79e07.pdf
- https://static.s123-cdn-static.com/uploads/4418370/normal_5fdde10937702.pdf
- https://s3.amazonaws.com/sasufufa/mycbseguide_class_10_english_grammar.pdf
- https://static1.squarespace.com/static/5fc2fb2a40f1034a5cb68ea9/t/5fcf2aab505b451de18753a5/1607412399083/nike_sports_bra_non_padded.pdf
- https://uploads.strikinglycdn.com/files/0da6e928-2b63-4bb5-824d-045283d2a082/pokemon_mega_adventure_controls.pdf
- https://uploads.strikinglycdn.com/files/5191f020-159d-4cc5-a53d-c1c2e8e460a6/medidas_de_canchas_de_voleibol_profesional.pdf
- https://uploads.strikinglycdn.com/files/37222b60-9ff6-40b6-b373-0a646c98c6d9/14087145535.pdf
- https://s3.amazonaws.com/wanasuvedigo/novation_launchpad_app_download.pdf
- https://static1.squarespace.com/static/5fdd52f8c2d4633280e99069/t/5fddcac32629b066aba66a97/1608370883922/vagovuxajupisubasiwiwikid.pdf
- https://uploads.strikinglycdn.com/files/3e843cf6-5cdc-4e5b-9e28-942c8b675b21/12593039915.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.