PDF malware analysis — malicious · 535c515529cdac3d

MALICIOUS

PDF

11.5 KB Created: 2020-10-09 03:56:49 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-06-30

MD5: bd1308f903b92e429545d1587107f8b4 SHA-1: f3c93cc9ff8f6284186fb225f663187ed1550e41 SHA-256: 535c515529cdac3d84b80576a8669d7cb72ede96a0e32facb7f494e735868560

92 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF file contains an embedded URL that points to known malicious redirector infrastructure. The ML classifier also flagged this PDF as malicious with a high probability. While no scripts were extracted, the presence of a malicious link suggests an attempt to lure the user to a compromised site, likely for further exploitation or credential harvesting.

Machine Learning

Nyx PDF Classifier malicious score 0.9895

Heuristics 2

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL https://ggtraff.ru/strik?keyword=collapse+of+the+republic+pdf+ffg In PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.