PDF malware analysis — malicious · c79a3a5fd6d348d0

MALICIOUS

PDF

50.2 KB Created: 2020-11-25 00:30:04 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: ea3f38c4b63dd4bf698f4e7359910b83 SHA-1: d0636a320642adc21588612730febffc4a02704e SHA-256: c79a3a5fd6d348d033f8d3495b32a0fe7e7b40873e608f3a83ca7de3c4840396

172 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF was identified as malicious by multiple heuristics, including a critical finding for a malicious redirector link. The document structure suggests it's an image-only lure, typical for phishing, with a single embedded URL pointing to known malicious infrastructure. The ML classifier and ClamAV detection further support its malicious nature.

Machine Learning

Nyx PDF Classifier malicious score 0.7011

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE

PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 50 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ggtraff.ru/123?utm_term=ls6+cam+specs+02
- https://jawifimubagibe.weebly.com/uploads/1/3/4/3/134310986/6311731.pdf
- https://dudererojafa.weebly.com/uploads/1/3/4/3/134362298/tugom_lujajov.pdf
- https://kivuligob.weebly.com/uploads/1/3/0/8/130874143/7cd13f8aa.pdf
- https://xilizotuxepaxi.weebly.com/uploads/1/3/4/3/134309236/xokazigema_jizijuribat_ninapanitukepek.pdf
- https://suxarunulabi.weebly.com/uploads/1/3/4/8/134854185/028616de.pdf
- https://pumewigegokofav.weebly.com/uploads/1/3/4/3/134317234/3223276.pdf
- https://uploads.strikinglycdn.com/files/5829cdf0-8365-41e9-8baa-0c78bdc1b7ec/zeziwutoputijejiv.pdf
- https://s3.amazonaws.com/rerinago/racor_filter_2020pm_price.pdf
- https://s3.amazonaws.com/xukonakefules/transport_in_plants_worksheet_answers.pdf
- https://s3.amazonaws.com/vavejijitatofu/pozafurev.pdf
- https://s3.amazonaws.com/fovezewi/powerful_verbs_ks2_worksheet.pdf
- https://s3.amazonaws.com/likerajatob/2038654643.pdf
- https://s3.amazonaws.com/lekizopiloref/3039408228.pdf
- https://s3.amazonaws.com/gaxuremewuger/95446609148.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.