PDF malware analysis — malicious · 86e51202112a3411

MALICIOUS

PDF

59.7 KB Created: 2020-12-27 17:40:20 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 24f4f85996ac62b055ce1155edbd50f7 SHA-1: 962ff62a10736716ec02891fc8095a8ef3de3004 SHA-256: 86e51202112a3411b1928909b82d8e4dadd45b5cec56686f1ee4421a03b82797

154 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

This PDF file contains numerous external links, a common tactic for SEO link farms and phishing. One prominent URL, 'https://traffnew.ru/strik?utm_term=soap+cutting+machine+in+bangalore', appears to be a lure to a malicious site. ClamAV detection and ML classification further indicate malicious intent, likely related to phishing or malware distribution.

Machine Learning

Nyx PDF Classifier malicious score 0.6200

Heuristics 4

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://traffnew.ru/strik?utm_term=soap+cutting+machine+in+bangalore
- https://cdn-cms.f-static.net/uploads/4413566/normal_5f999b0fb3097.pdf
- https://vijipivefewari.weebly.com/uploads/1/3/4/6/134624644/95ae063f4.pdf
- https://cdn.sqhk.co/sofopiro/ibcyhgu/download_english_songs_love_me_like_you_do.pdf
- https://foxegakadop.weebly.com/uploads/1/3/4/3/134337736/c953f9d099ff47.pdf
- https://xavozunop.weebly.com/uploads/1/3/4/3/134305705/figavirisi.pdf
- https://cdn-cms.f-static.net/uploads/4370987/normal_5fd12e9f61f4e.pdf
- https://static.s123-cdn-static.com/uploads/4410731/normal_5fcab73df03e4.pdf
- https://uploads.strikinglycdn.com/files/adb267e1-6e2e-40c7-9f91-42d62f6478bb/tu_vi_2020_giap_ty.pdf
- https://uploads.strikinglycdn.com/files/e724caec-55b2-4ea1-afa9-65e9da4b4edc/100_secretos_de_pomada_de_la_campana.pdf
- https://uploads.strikinglycdn.com/files/58e53247-0dfa-4d0f-bc3c-fadd03bc0354/fisher_price_camera_toy.pdf
- https://uploads.strikinglycdn.com/files/d2bb078a-e32e-4215-abb0-ff65f8f0658c/tososabugi.pdf
- https://uploads.strikinglycdn.com/files/a4f1e76f-6184-4ac5-ac4f-69ac2cf143d5/coulombs_law_problems_worksheet.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.