PDF malware analysis — malicious · 86b86e74468a5927

MALICIOUS

PDF

68.6 KB Created: 2021-05-14 07:59:24 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-08-25

MD5: e975b108f186b3187f7e8d5ad3784c27 SHA-1: 2990c32be01237f88f8c15475a47a0ee8defba2e SHA-256: 86b86e74468a59279735da3ea11107e8a1fd8c9bc0096e88843435e863a778d5

134 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF file contains a heuristic firing indicating it is a phishing lure for free downloads, which redirects to an external URL. The embedded URL, https://leonvi.ru/strik?utm_term=how+to+see+f+table, is identified as a redirector. ClamAV also detected this file as a phishing trojan. No scripts were extracted from this sample.

Machine Learning

Nyx PDF Classifier malicious score 0.6002

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK

PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://leonvi.ru/strik?utm_term=how+to+see+f+table PDF link annotation
- https://cdn-cms.f-static.net/uploads/4421462/normal_604cd747cd6ff.pdfIn PDF document text
- https://cdn.sqhk.co/mapelimujeku/kriejfe/wopijunekekinerivuxuz.pdfIn PDF document text
- https://cdn.sqhk.co/gejupajo/xRgihaJ/99._5_the_wolf_playlist_dallas.pdfIn PDF document text
- http://huseyincanx.com/oak_wood_school_deskpxg1g.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4459914/normal_5fe89ddabe0e6.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4412900/normal_6006dad8ab9b6.pdfIn PDF document text
- http://formverifiedbadge.com/2830536022365dnd.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4471683/normal_5fe90acdaf3cd.pdfIn PDF document text
- http://ryursew.space/good_weight_lifting_routine_for_beginnersgt6tn.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4469626/normal_5fe0b4b447d1f.pdfIn PDF document text
- https://s3.amazonaws.com/kodipopujufipig/a_b_c_d_movie_ringtone.pdfIn PDF document text
- http://wodedane.rf.gd/isabel_allende_livro_paula.pdfIn PDF document text
- https://s3.amazonaws.com/toliwudalamem/weight_watchers_digital_glass_scale_reviews.pdfIn PDF document text
- https://s3.amazonaws.com/ziwuvijevo/cloudformation_get_s3_bucket_arn.pdfIn PDF document text
- https://s3.amazonaws.com/mibiwivanetuj/madhura_raja_collection_report.pdfIn PDF document text
- http://sumabaxesopev.rf.gd/methyl_orange_dye.pdfIn PDF document text
- https://s3.amazonaws.com/nijosinizo/warekumekak.pdfIn PDF document text
- https://s3.amazonaws.com/jepinebawo/36614650501.pdfIn PDF document text
- https://s3.amazonaws.com/nuvukivaxiren/portable_fly_tying_desk_plans.pdfIn PDF document text
- http://jutoxuriwiloja.epizy.com/ceftriaxona_im_bula.pdfIn PDF document text
- http://wowejatilubus.epizy.com/kozotoriwu.pdfIn PDF document text
- https://s3.amazonaws.com/rumezo/adato_me_tum_song.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.