Malicious PDF — malware analysis report

Static analysis result for SHA-256 9907558379f179b7…

MALICIOUS

PDF

79.0 KB Created: 2020-12-26 01:20:13 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-27
MD5: ed63c22cced6c575e800277f0450515b SHA-1: 275fcc6192a0207a4e834bc8977bc15829ca4524 SHA-256: 9907558379f179b78b856b04b5a75f8e320ddb58c0ba447e03817157563f580e
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file contains a heuristic firing for a malicious redirector link pointing to 'https://gettraff.ru/123?utm_term=biblical+meaning+of+90'. The ML classifier also flagged the document as malicious. While no scripts were extracted, the presence of a malicious URL strongly suggests a phishing attempt, likely delivered as an attachment.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7543

Heuristics 3

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://gettraff.ru/123?utm_term=biblical+meaning+of+90 In PDF document text
    • https://static.s123-cdn-static.com/uploads/4379374/normal_5fe46d763ed93.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4460690/normal_5fdb2b20ce296.pdfIn PDF document text
    • https://s3.amazonaws.com/lupuvogotog/o_saki_saki_video_song_hd.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2eb4d5f0-6b8b-4501-be11-e78ea404ebfc/flores_para_algernon_resumen.pdfIn PDF document text
    • https://s3.amazonaws.com/nuxomigo/73431451261.pdfIn PDF document text
    • https://s3.amazonaws.com/xonaxevetaf/important_information_about_computer_network.pdfIn PDF document text
    • https://s3.amazonaws.com/takurugilij/nemuzuronofiri.pdfIn PDF document text
    • https://s3.amazonaws.com/kefefetafij/blank_basketball_jersey_template_psd.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4eb70d5d-9a02-471f-bb5c-e284f918c959/bovalezixigukitobopatu.pdfIn PDF document text
    • https://s3.amazonaws.com/sixenogafopoj/businessman_telugu_movie_720p_tamilrockers.pdfIn PDF document text
    • https://s3.amazonaws.com/bifamomove/84543466655.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7dfe7d0f-e7de-4003-b57d-3c8dffa04819/42391931065.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/abb9d740-d4d3-41e8-b031-783300d5d195/63463255234.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f0328e99-a85d-47e1-888f-2916745a80e7/stephen_curry_wingspan_in_feet.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/69d3ec2e-6d38-4165-a169-3a447a05c216/watch_bobs_burgers_online.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ffe2edc7-f479-4009-9a03-0c7a6f7b8284/kekarixova.pdfIn PDF document text
    • https://s3.amazonaws.com/genedonapubefe/wipix.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.