Malicious PDF — malware analysis report

Static analysis result for SHA-256 99bdea656d605306…

MALICIOUS

PDF

423.6 KB Created: 2020-11-11 21:47:27 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-27
MD5: a24e9dad802eac7f0e9b8d5eb1ff42c0 SHA-1: c9125834573cb81c5ea404cc9c175bb87757dbe9 SHA-256: 99bdea656d605306b41ed79da09115a9ee9a8d56c4cbaa999ec4504cfda662fa
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The file is a PDF containing a malicious redirector link to 'traffking.ru'. This indicates an attempt to lure the user to a potentially malicious website. The ML classifier and ClamAV detection further support its malicious nature. No scripts were extracted, but the presence of a malicious URL is a high-priority indicator.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9365

Heuristics 3

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffking.ru/aws?utm_term=aeroplane+aerodynamics+structures+and+systems+pdf In PDF document text
    • https://farisogu.weebly.com/uploads/1/3/4/3/134307724/2390156.pdfIn PDF document text
    • https://texitanoz.weebly.com/uploads/1/3/0/7/130739996/aeefcf0.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4369522/normal_5f890cb78df21.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4393785/normal_5fa0b83210f03.pdfIn PDF document text
    • https://kivuligob.weebly.com/uploads/1/3/0/8/130874143/mokiwated.pdfIn PDF document text
    • https://jatasurow.weebly.com/uploads/1/3/4/3/134358583/c3c04705fb3a59.pdfIn PDF document text
    • https://fidevawane.weebly.com/uploads/1/3/0/8/130814252/4a8d5db.pdfIn PDF document text
    • https://kudipunebux.weebly.com/uploads/1/3/4/5/134509365/4e8b588f99b.pdfIn PDF document text
    • https://tenasusuboziwid.weebly.com/uploads/1/3/4/3/134349012/06c6d8e4c9f3493.pdfIn PDF document text
    • https://goduvozimaku.weebly.com/uploads/1/3/1/3/131380582/bdc79a9ff18576.pdfIn PDF document text
    • https://jimigafekalese.weebly.com/uploads/1/3/1/4/131407537/tunovut.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/eb669faa-0d9d-41cd-aff5-f0c0e587e2ef/26695332621.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/10c52508-3966-432b-ab22-b4f0de649e0e/richard_elmore_instructional_core.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.