PDF malware analysis — malicious · 57b5cc1244fe7561

MALICIOUS

PDF

49.6 KB Created: 2020-12-25 21:54:16 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: e70a9bae13e9cbce069607f91111de3d SHA-1: 83bc7ce77259104f933e3620ec1f7e22fae920c3 SHA-256: 57b5cc1244fe7561daeb1fb22d7276b8aec663ceb482ea0f796547dd7685a9bc

152 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF file contains a link that redirects to a known malicious domain, identified by the PDF_MALICIOUS_REDIRECTOR_LINK heuristic. The ML classifier also flagged the document as malicious. The embedded URL is designed to deceive users into clicking it, likely leading to a phishing or malware download site.

Machine Learning

Nyx PDF Classifier malicious score 0.6851

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://traffmen.ru/strik?utm_term=change+my+voicemail+greeting+iphone+6
- https://cdn-cms.f-static.net/uploads/4371791/normal_5f8c5c09748ab.pdf
- https://static.s123-cdn-static.com/uploads/4458827/normal_5fde24e38a3e0.pdf
- https://cdn-cms.f-static.net/uploads/4403807/normal_5fb74c2892d39.pdf
- https://cdn-cms.f-static.net/uploads/4381531/normal_5f8c98d24567f.pdf
- https://cdn-cms.f-static.net/uploads/4415930/normal_5fa634a8ea0fd.pdf
- https://cdn-cms.f-static.net/uploads/4464529/normal_5fd111f275426.pdf
- https://s3.amazonaws.com/pibabopuduj/boxing_training_schedule.pdf
- https://s3.amazonaws.com/xakapudakadu/sweet_gum_tree_fruit.pdf
- https://s3.amazonaws.com/kulinisokakewi/causes_of_ethnic_conflict_in_kenya.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.