Malicious PDF — malware analysis report

Static analysis result for SHA-256 940c55639cc2b346…

MALICIOUS

PDF

49.6 KB Created: 2020-12-18 23:43:25 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: bb88adc17d9b3daaf6bfae6095b4ef7d SHA-1: f44502a3d1fc9c3283e67ead35b83e36222ce54f SHA-256: 940c55639cc2b34615a0a3fc2e52115a803a242a0959ebd128a6968604be3f66
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file contains a heuristic firing indicating it links to known malicious redirector infrastructure. The embedded URL 'https://ggtraff.ru/aws?utm_term=arkansas+final+franchise+tax+report+form' is identified as a malicious redirector. The document body, though heavily obfuscated, suggests a lure related to tax forms, which is a common phishing tactic.

Machine Learning

  • Nyx PDF Classifier malicious score 0.6779

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ggtraff.ru/aws?utm_term=arkansas+final+franchise+tax+report+form
    • https://lelebozo.weebly.com/uploads/1/3/4/5/134578107/9630748.pdf
    • https://cdn-cms.f-static.net/uploads/4386092/normal_5fc0209da9d02.pdf
    • https://cdn-cms.f-static.net/uploads/4376086/normal_5fb83e08a9a8f.pdf
    • https://rutaluxunenore.weebly.com/uploads/1/3/0/7/130740368/lilelefumowugor-fugirurizeta-dobipebebimipa-dapolog.pdf
    • https://cdn-cms.f-static.net/uploads/4492575/normal_5fac4def18380.pdf
    • https://cdn-cms.f-static.net/uploads/4461211/normal_5fad9ac8eaabb.pdf
    • https://static.s123-cdn-static.com/uploads/4464707/normal_5fc8afd652ae4.pdf
    • https://s3.amazonaws.com/vaxebisapesi/national_clogging_cue_sheets.pdf
    • https://uploads.strikinglycdn.com/files/144bb075-8272-4a4c-bdca-fb13370d7b34/bob_psiphon_2_apk.pdf
    • https://uploads.strikinglycdn.com/files/f571c3f9-e5bc-42a6-9179-6b0dc35ce7ae/pibajivogapajopotofekabuj.pdf
    • https://s3.amazonaws.com/luramamelolem/american_heart_association_bls_test_answers_2017.pdf
    • https://s3.amazonaws.com/zevutebulaworel/bobby_dassey_age.pdf
    • https://s3.amazonaws.com/zonebon/iras_gst_general_guide.pdf
    • https://uploads.strikinglycdn.com/files/2405eb18-935f-4ced-bded-251a88ccc4b1/volos_guide_to_everything.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.