PDF malware analysis — malicious · aa22080575e3d8c5

MALICIOUS

PDF

50.6 KB Created: 2020-11-20 02:57:31 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 96f1abf190247badb3055312f13a69f4 SHA-1: d30ec5e3939cb4da86951905502df170307a104c SHA-256: aa22080575e3d8c54084c75c0cc25a13e4941b7b15cd03c93ae83c3f49c069f3

212 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF contains numerous links to external websites, including one identified as a malicious redirector. The document body, though heavily obfuscated, suggests a lure related to "Printed circuit board design guide pdf". The presence of many PDF links and a malicious redirector indicates an attempt to lead users to potentially harmful content, likely for phishing or malware distribution.

Machine Learning

Nyx PDF Classifier malicious score 0.8593

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ggtraff.ru/aws?utm_term=printed+circuit+board+design+guide+pdf
- https://cdn-cms.f-static.net/uploads/4449405/normal_5fb5fe04ecec5.pdf
- https://cdn-cms.f-static.net/uploads/4365555/normal_5f8cfdbb32ea4.pdf
- https://kezojafedekekav.weebly.com/uploads/1/3/4/0/134096401/fuxowonuvosebev_nuwenozav_tesojitobuziv_samotapu.pdf
- https://setivegubuwo.weebly.com/uploads/1/3/4/4/134446573/lepotigife-kixalam.pdf
- https://cdn-cms.f-static.net/uploads/4425915/normal_5fae0482ce58e.pdf
- https://cdn-cms.f-static.net/uploads/4366306/normal_5f99311bbca6a.pdf
- https://devomejot.weebly.com/uploads/1/3/4/4/134491467/lakibop_bexijawemapozub_davikazopixovok.pdf
- https://cdn-cms.f-static.net/uploads/4394082/normal_5f99c54c04eaa.pdf
- https://gokopawe.weebly.com/uploads/1/3/4/4/134493337/voxexinelosiremejas.pdf
- https://s3.amazonaws.com/dibedamoka/retetiwamevet.pdf
- https://uploads.strikinglycdn.com/files/ae729cf9-2c2f-426f-a219-29a46d597272/99787338873.pdf
- https://s3.amazonaws.com/zetare/vuxewemizakodopikopolovit.pdf
- https://s3.amazonaws.com/vigevot/eeoc_intake_questionnaire.pdf
- https://s3.amazonaws.com/wozibap/target_solutions_login_page_pgfd.pdf
- https://s3.amazonaws.com/zarelusipofox/najifutomopuku.pdf
- https://s3.amazonaws.com/mokixetat/pond_filter_foam_sheet_near_me.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.