Malicious PDF — malware analysis report

Static analysis result for SHA-256 823405ae98849f06…

MALICIOUS

PDF

50.6 KB Created: 2020-12-27 17:42:12 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 6c20da6ccea9d6f2f69573b20d251691 SHA-1: aba18a6816a28616c3a456592ef019c51eff9757 SHA-256: 823405ae98849f060cb7caf2a850daaee8e7be58d5cd360783e3a43837117d6e
172 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF document is identified as malicious due to its structure, which resembles a screenshot lure designed to trick users into clicking a link. The embedded URL, https://traffmen.ru/aws?utm_term=zombie+catchers+apk+mod+latest+version, is flagged as a known malicious redirector. The document's content is heavily obfuscated, but the presence of a malicious redirector strongly suggests an intent to lead the user to a phishing site or a download of further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7327

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE
    PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 50 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffmen.ru/aws?utm_term=zombie+catchers+apk+mod+latest+version
    • https://cdn-cms.f-static.net/uploads/4424027/normal_5fa98dfd0f408.pdf
    • https://cdn-cms.f-static.net/uploads/4420924/normal_5fa9072a8f23a.pdf
    • https://static.s123-cdn-static.com/uploads/4470688/normal_5fde3c4a57a96.pdf
    • https://cdn-cms.f-static.net/uploads/4367268/normal_5f8755c8934ec.pdf
    • https://cdn-cms.f-static.net/uploads/4453129/normal_5fa7f7b44b223.pdf
    • https://cdn-cms.f-static.net/uploads/4407777/normal_5fa1466ef1e74.pdf
    • https://cdn-cms.f-static.net/uploads/4450259/normal_5fc1783d610f9.pdf
    • https://s3.amazonaws.com/muxegeza/btc_first_semester_science.pdf
    • https://s3.amazonaws.com/purufiz/hercules_film_parents_guide.pdf
    • https://s3.amazonaws.com/vatosolikijike/profit_and_loss_statement_template.pdf
    • https://uploads.strikinglycdn.com/files/833acdc8-1cf3-400d-b5f3-cc5659a246d0/manual_push_lawn_mower_home_depot.pdf
    • https://uploads.strikinglycdn.com/files/39168d06-02f8-4597-8b65-8a361fc70ddb/72854287496.pdf
    • https://s3.amazonaws.com/bidemewufa/47376293942.pdf
    • https://s3.amazonaws.com/boxalewijim/free_property_damage_report_forms.pdf
    • https://uploads.strikinglycdn.com/files/3cc85498-69ff-4473-a1d9-fbd03be98ad7/53945640240.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.