Malicious PDF — malware analysis report

Static analysis result for SHA-256 57ad87856f2317a2…

MALICIOUS

PDF

16.0 KB Created: 2020-10-30 04:22:45 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 959c016d6613bc5105bc3b755832119b SHA-1: 33fbbee1b74bfef8ac07e3c8245f39aad6366faa SHA-256: 57ad87856f2317a25654c6d28d9d2e8664b23f6b96250c7cbb9bc0b5ae111438
112 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF is an image-only document designed as a lure, containing a clickable link to a known malicious redirector. The embedded URL, https://ttraff.ru/123?keyword=asa+fastpitch+softball+pitching+rules+2015, is the primary indicator of malicious intent. The document's structure and the presence of this link strongly suggest a phishing or malware delivery attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9981

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE
    PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 16 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/123?keyword=asa+fastpitch+softball+pitching+rules+2015
    • https://cdn-cms.f-static.net/uploads/4373511/normal_5f9a34919bef5.pdf
    • https://cdn-cms.f-static.net/uploads/4379961/normal_5f90029d6aa19.pdf
    • https://cdn-cms.f-static.net/uploads/4424647/normal_5f9a033cbcd61.pdf
    • https://zosupexaduj.weebly.com/uploads/1/3/0/7/130738593/gamazug-nugozisonazadar.pdf
    • https://gewusepisegetu.weebly.com/uploads/1/3/4/4/134492884/87fc13813b91cb.pdf
    • https://cdn-cms.f-static.net/uploads/4421038/normal_5f967611d77f1.pdf
    • https://zozelezike.weebly.com/uploads/1/3/4/4/134434207/zilen-vogaruvav-binaxabu-tikijepejo.pdf
    • https://cdn-cms.f-static.net/uploads/4373753/normal_5f8d27ae165e9.pdf
    • https://cdn-cms.f-static.net/uploads/4420468/normal_5f9abbff1bc2a.pdf
    • https://cdn.shopify.com/s/files/1/0432/6601/5396/files/jalazinuxokasesebojitile.pdf
    • https://s3.amazonaws.com/resixexi/dog_blow_dryer_attachments.pdf
    • https://cdn.shopify.com/s/files/1/0505/4493/5095/files/lexonogap.pdf
    • https://s3.amazonaws.com/donake/nefopemo.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.