Malicious PDF — malware analysis report

Static analysis result for SHA-256 77802c0eea4e34ab…

MALICIOUS

PDF

49.6 KB Created: 2021-01-16 14:30:32 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-14
MD5: 1311e88a7a50ed2ddba03d72609f88c3 SHA-1: 5a2eac76396c00b66ebc1c323551e6b6f8a08856 SHA-256: 77802c0eea4e34abd9a6397180feda3106cc9695dc026aea730b1de667a451e1
212 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains numerous embedded links, many of which point to suspicious domains and are identified as part of a link farm. One critical heuristic indicates that the PDF links to known malicious redirector infrastructure. The ClamAV detection and ML classifier further support its malicious nature, classifying it as a phishing trojan.

Machine Learning

  • Nyx PDF Classifier malicious score 0.6502

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://gettraff.ru/aws?utm_term=smoky+mountains+leaf+color+report In PDF document text
    • https://cdn.sqhk.co/tuledapozato/jbwWLXo/mivuzusat.pdfIn PDF document text
    • https://gosabotef.weebly.com/uploads/1/3/4/3/134332229/7682722.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4368777/normal_5f8818f264543.pdfIn PDF document text
    • https://cdn.sqhk.co/wavagowew/jzhfhiM/thrift_stores_near_me_clothes.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4420441/normal_5fc37aa8701b6.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4408981/normal_5ff5020475814.pdfIn PDF document text
    • https://cdn.sqhk.co/gerukoso/ibihjiy/58742285979.pdfIn PDF document text
    • https://cdn.sqhk.co/xejudawadoni/evhdHFh/91776802182.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4447647/normal_5faab72a32fe9.pdfIn PDF document text
    • https://s3.amazonaws.com/bubisifapagefe/banco_safra_s._a._annual_report_2017.pdfIn PDF document text
    • https://s3.amazonaws.com/zuxadol/mumiwadamulisokub.pdfIn PDF document text
    • https://s3.amazonaws.com/tixeligufokup/calendario_2020_chile_para_imprimir.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.