PDF malware analysis — malicious · 6ab70f35d22b7e53

MALICIOUS

PDF

1.1 KB First seen: 2021-05-22

MD5: 3fabe901b9edd056e09255466c052047 SHA-1: 7c7954c370b8c43a96fbcbb37120e5b325d6f349 SHA-256: 6ab70f35d22b7e539e469d3e03e182a9ec6d01c7aabc85e88edb5e92a5a91064

112 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF contains a direct link to an executable file hosted on an IP address, which is a strong indicator of a malicious payload delivery. The embedded URL and the ML classifier strongly suggest this document is designed to trick users into downloading and running malware. The document body itself contains the malicious URL, reinforcing the attack vector.

Machine Learning

Nyx PDF Classifier malicious score 0.9989

Heuristics 3

PDF link points directly to executable/archive payload critical PDF_DIRECT_PAYLOAD_LINK

PDF contains a clickable HTTP(S) URI whose path ends in an executable, script, shortcut, disk image, or archive extension. Documents can legitimately link to installers, so this is a high-risk delivery indicator rather than a standalone exploit fingerprint.
Clickable URI points to raw IP address medium PDF_URI_IP_LITERAL

PDF contains a clickable HTTP(S) action whose host is a literal IPv4 address. Legitimate documents normally link to named domains; raw-IP destinations are common in disposable phishing and malware-delivery infrastructure.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://31.210.20.90/cxz/PO29664117.exe PDF link annotation

Open this report in the interactive analyzer, or submit your own file for analysis.