PDF malware analysis — malicious · 896e503ddbeab81c

MALICIOUS

PDF

16.6 KB Created: 2020-11-09 15:06:28 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 75c6d2578f5b091a3e7e2644cf38b8bf SHA-1: 837e7470388ac00b1ef23eb657011d9946f1f2bd SHA-256: 896e503ddbeab81c16309a888fab9ad26ec45fe62b0790f588b344f17d325fc7

112 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

This PDF document is designed as a lure, presenting itself as a software keygen but containing a clickable link that redirects to malicious infrastructure. The heuristic 'PDF_MALICIOUS_REDIRECTOR_LINK' confirms that the embedded URL leads to known malicious redirector infrastructure. The document body contains obfuscated text and a URL, suggesting an attempt to disguise the malicious intent. No scripts were extracted from this sample.

Machine Learning

Nyx PDF Classifier malicious score 0.9955

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE

PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 16 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://cctraff.ru/aws?keyword=cyberlink+powerdirector+16+keygen
- https://cdn-cms.f-static.net/uploads/4368226/normal_5f8761ee6f0ae.pdf
- https://lamuvoraraxuz.weebly.com/uploads/1/3/4/4/134486612/zumuriw.pdf
- https://xekijepomi.weebly.com/uploads/1/3/4/5/134508866/9157188.pdf
- https://vopevejefed.weebly.com/uploads/1/3/1/6/131606133/9de629b19.pdf
- https://cdn-cms.f-static.net/uploads/4365582/normal_5f88b464c9acc.pdf
- https://tolajugim.weebly.com/uploads/1/3/4/6/134647220/logum.pdf
- https://nuzixusimupe.weebly.com/uploads/1/3/4/3/134306281/zovomumawa.pdf
- https://uploads.strikinglycdn.com/files/df5f74dd-cf9e-4103-b638-f693b89b4fab/muskurane_ki_wajah_mp3_download.pdf
- https://uploads.strikinglycdn.com/files/debe7ae6-bd60-4fc4-a440-21cb38e4f3da/panosonic_lumix_g1.pdf
- https://uploads.strikinglycdn.com/files/2c7a0dab-b55c-47f0-9f67-d893d39b736f/99498300288.pdf
- https://s3.amazonaws.com/zabevog/sasadapexaganinitudedilap.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.