Malicious PDF — malware analysis report

Static analysis result for SHA-256 949ed6ca260ca180…

MALICIOUS

PDF

51.0 KB Created: 2020-12-18 16:15:08 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 6af0bf48f911434440dfb5a89e159f67 SHA-1: ce4b7defccd8f7b83e23e83cfd0a6a3bed83f970 SHA-256: 949ed6ca260ca180391ae2b8d36c5305832e4587500f0e14698ce5d429fd41ce
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a critical heuristic firing indicating it links to known malicious redirector infrastructure. The primary malicious URL identified is 'https://gettraff.ru/strik?utm_term=dearborn+county+auditor+website'. While no scripts were explicitly extracted, the PDF structure and the presence of embedded URLs suggest an attempt to lure the user to a compromised site, likely for phishing or to download a secondary payload. The ML classifier also flagged the document as malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7874

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://gettraff.ru/strik?utm_term=dearborn+county+auditor+website
    • https://gedevuxezupimot.weebly.com/uploads/1/3/4/8/134884710/7f8dc1de.pdf
    • https://jovikuveditowe.weebly.com/uploads/1/3/0/8/130874612/e2b1cf49a3.pdf
    • https://xavoxoxuda.weebly.com/uploads/1/3/1/3/131379246/39a4ef783bbbee.pdf
    • https://valetakomo.weebly.com/uploads/1/3/4/0/134012509/5045302.pdf
    • https://regafuraseni.weebly.com/uploads/1/3/4/6/134663643/mabiwutaputasoruve.pdf
    • https://static1.squarespace.com/static/5fc3806ebd14ff0dd2ad09c5/t/5fcdeecd2fa8bc6bcd0caf92/1607331534407/lucky_block_mod_mcpe_free_download.pdf
    • https://uploads.strikinglycdn.com/files/26588836-1e16-49ee-8b8d-36b0277ef3a3/hp_17-g121wm_cooling_fan.pdf
    • https://uploads.strikinglycdn.com/files/29c8ea91-f255-4834-8a82-cbeb010695dd/splash_and_dash_locations.pdf
    • https://uploads.strikinglycdn.com/files/71c2dd00-d5e8-4458-a8c6-b6c450f984e7/jufixagozafewutititob.pdf
    • https://static1.squarespace.com/static/5fc5166417e7202640051625/t/5fc97b4d41142a3c4b329fdd/1607039827094/40296922483.pdf
    • https://static1.squarespace.com/static/5fc1012fe5c7695ca99c31f6/t/5fc128a53570fb44d12c93a8/1606494373429/physics_of_semiconductor_devices_sze_solution_manual.pdf
    • https://static1.squarespace.com/static/5fc559d7df132613bbdb3256/t/5fc88444f97c193540f25ca7/1606976581278/29334704833.pdf
    • https://static1.squarespace.com/static/5fc59b7d2cf09257bd8b9178/t/5fd6fd6c13a48350e828638e/1607925102398/fayette_county_texas_sheriff_report.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.