PDF malware analysis — malicious · 67f5d668966ff5b4

MALICIOUS

PDF

50.6 KB Created: 2020-12-21 04:51:17 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: c66e3a20dc1ffd59e043da0a1d435a55 SHA-1: b469cc309163d6ca034b4587064461e1345d0a2b SHA-256: 67f5d668966ff5b42da723b1af9a751457da2310ae8d7dc9986447f56df196e4

172 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF was identified as malicious by multiple heuristics, including a critical alert for a link to known malicious redirector infrastructure. The document structure suggests it's an image-based lure, typical of phishing attempts. The primary malicious IOC is the redirector URL, which likely leads to a phishing page or malware download.

Machine Learning

Nyx PDF Classifier malicious score 0.7360

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE

PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 50 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://cctraff.ru/aws?utm_term=game+captain+tsubasa+ps2+tanpa+emulator
- https://static.s123-cdn-static.com/uploads/4469359/normal_5fca6ef220789.pdf
- https://cdn-cms.f-static.net/uploads/4369928/normal_5f88aac52c7fc.pdf
- https://s3.amazonaws.com/tesasubawalozan/start_high_school_twitter.pdf
- https://s3.amazonaws.com/rowubunak/21713558670.pdf
- https://s3.amazonaws.com/vunizi/amenorrhea_2017.pdf
- https://s3.amazonaws.com/dojonuta/rebarubiwuxuwukexu.pdf
- https://s3.amazonaws.com/niwotipugonuvoz/broadcast_application_form.pdf
- https://static1.squarespace.com/static/5fde88431076b30d0a95c29a/t/5fdfb38f7f4e6a33673e1281/1608496016456/contoh_formulir_banquet_event_order.pdf
- https://s3.amazonaws.com/polojuliragam/cambridgeshire_county_council_blue_badge_application_form.pdf
- https://s3.amazonaws.com/sivanira/backtrack_5_r3_si_reaver.pdf
- https://static1.squarespace.com/static/5fdeceaccb96363ef0bb8f98/t/5fdfc2747514fb3b76649a6b/1608499828784/70091235100.pdf
- https://s3.amazonaws.com/nuxulikiwab/bledisloe_cup_2018_tv_guide.pdf
- https://s3.amazonaws.com/rafiralexezol/anfrage_auf_englisch_formulieren.pdf
- https://s3.amazonaws.com/wovugi/galmeetsglam_charleston_guide.pdf
- https://static1.squarespace.com/static/5fced9dd84361f7a2d9cbdd7/t/5fd13bd89deafa3d82cf39a1/1607547865511/52633413675.pdf
- https://static1.squarespace.com/static/5fdfda9307af9e0e16040623/t/5fe0072d2baf317dc3bb66f7/1608517422884/95625850137.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.