Malicious PDF — malware analysis report

Static analysis result for SHA-256 b3da30f59a48790b…

MALICIOUS

PDF

146.1 KB Created: 2021-03-28 19:17:48 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: dd3545fa81e14af823511b08bbef7cb5 SHA-1: 033c6f636053117f7fc63780146dc3fabda4f858 SHA-256: b3da30f59a48790bc1893826a539a8dc50546609407597ba9af56c9fb25fe8d1
122 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file contains a link to a known malicious redirector infrastructure, indicating a phishing or malware distribution attempt. The embedded URL, 'https://yafferge.ru/award?keyword=gmo+meaning+pdf', is directly associated with malicious activity. The ClamAV detection further confirms the malicious nature of the file, classifying it as a phishing trojan.

Machine Learning

  • Nyx PDF Classifier clean score 0.2413

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://yafferge.ru/award?keyword=gmo+meaning+pdf

Open this report in the interactive analyzer, or submit your own file for analysis.