Malicious PDF — malware analysis report

Static analysis result for SHA-256 aa78fbf4e2da2810…

MALICIOUS

PDF

156.1 KB Created: 2020-08-23 22:45:37 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: f6951b73c85edc4206fccee59f172f68 SHA-1: 609b01807011d3b8c2b9146711dd8188bf06cdcd SHA-256: aa78fbf4e2da2810096c75d4dddc492ed3d9877b062de69e40ecf3a37616c0d9
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file contains a critical heuristic firing indicating a malicious redirector link. The embedded URL, https://ttraff.cc/pify?keyword=dict+cc+deutsch+rum%25C3%25A4nisch, is confirmed to point to known malicious infrastructure. While no scripts were explicitly extracted, the nature of PDF redirectors often involves JavaScript to facilitate the redirection, hence the inclusion of T1059.007.

Machine Learning

  • Nyx PDF Classifier clean score 0.1164

Heuristics 2

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/pify?keyword=dict+cc+deutsch+rum%25C3%25A4nisch

Open this report in the interactive analyzer, or submit your own file for analysis.