Malicious PDF — malware analysis report

Static analysis result for SHA-256 b818241111c4b603…

MALICIOUS

PDF

52.6 KB Created: 2020-12-03 15:37:45 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 1dacbc5f820285953e24db98ddddd84e SHA-1: c44e58012ef28557e0a99deb1c858fdd4917b714 SHA-256: b818241111c4b603c56a91e7694e55b1abb1f448f7ce901070fa431bab3a2a1f
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a critical heuristic firing for a malicious redirector link, pointing to 'https://gettraff.ru/aws?utm_term=hero+line+wars+starlight+garrison+guide'. This indicates the document's primary purpose is to lure the user to this malicious site. While no scripts were extracted, the presence of a malicious URL and the ClamAV detection strongly suggest a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.5596

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://gettraff.ru/aws?utm_term=hero+line+wars+starlight+garrison+guide
    • https://static1.squarespace.com/static/5fc0e85027a199023ab5619d/t/5fc5c081e6d49a06bb5a86f0/1606795394465/lalam.pdf
    • https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbf4b239d793648408446a2/1606372132473/dawuvazuwafidabexipileza.pdf
    • https://uploads.strikinglycdn.com/files/159dd368-1edc-44c0-8472-aa7b7a140855/vodivusitakunoxefonud.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.