PDF malware analysis — malicious · aeb7ca2516da7c44

MALICIOUS

PDF

52.6 KB Created: 2020-11-16 20:46:02 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: e2291876bd631f31100360d02b0eb668 SHA-1: f7c6e84990be7cd031fc48598b78b7a510ce9064 SHA-256: aeb7ca2516da7c4428e1aac22e58ab76187df79de43d5d0546ada12061e4f8c9

152 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF file contains a link to a known malicious redirector, which is designed to lead users to potentially harmful content. The embedded text, though heavily obfuscated, suggests a lure related to downloading software. The ML classifier and ClamAV detection further support the malicious nature of this file.

Machine Learning

Nyx PDF Classifier malicious score 0.9588

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ggtraff.ru/strik?utm_term=builder+for+minecraft+pro+download+apk
- https://cdn-cms.f-static.net/uploads/4393019/normal_5f9263e77f260.pdf
- https://cdn-cms.f-static.net/uploads/4453337/normal_5fae80b19b8d7.pdf
- https://cdn-cms.f-static.net/uploads/4389606/normal_5fad20991851a.pdf
- https://cdn-cms.f-static.net/uploads/4425238/normal_5fb2c8b972f1b.pdf
- https://cdn-cms.f-static.net/uploads/4387061/normal_5f8d5f63893b2.pdf
- https://cdn-cms.f-static.net/uploads/4491436/normal_5fb2b6e3ae850.pdf
- https://s3.amazonaws.com/pisedij/limitless_full_movie_123movie.pdf
- https://s3.amazonaws.com/sumesawoxajew/navy_service_uniform_female.pdf
- https://uploads.strikinglycdn.com/files/cd9d3709-0322-4974-b08c-99f70b1802eb/34254582803.pdf
- https://s3.amazonaws.com/jebokizez/29248345868.pdf
- https://uploads.strikinglycdn.com/files/396ae20d-44cc-4f7b-b7f8-34bfee505c80/karowunodugavaselixi.pdf
- https://uploads.strikinglycdn.com/files/2588f443-0ee4-4a68-9cc8-2bdb1f97a487/rufidukojefiloran.pdf
- https://s3.amazonaws.com/wejuvono/prodigy_p2_brake_controller_manual.pdf
- https://uploads.strikinglycdn.com/files/292d5acb-f3f8-460b-aa0f-80625a313480/60183758124.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.