Malicious PDF — malware analysis report

Static analysis result for SHA-256 ca80ffc5bc663c18…

MALICIOUS

PDF

42.2 KB Created: 2021-02-22 00:20:23 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-21
MD5: d260e9b932484e3dcf335f110532bc29 SHA-1: dc5cc26bc4d38a1d640a0a9f093c7e94d8ce6143 SHA-256: ca80ffc5bc663c18342d7137a2ed76e8dd51412fe34ead86beb46003f2bf7fd5
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a critical heuristic firing for a malicious redirector link pointing to 'https://yafferge.ru/strik?utm_term=pyplot+add+color+legend'. This indicates the document's primary purpose is to lure the user to a potentially malicious website. The ML classifier also flagged the PDF with a high score, and ClamAV detected it as a phishing trojan.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8368

Heuristics 3

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://yafferge.ru/strik?utm_term=pyplot+add+color+legend In PDF document text
    • https://cdn-cms.f-static.net/uploads/4366045/normal_6028824c14318.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4412568/normal_6014db61c3999.pdfIn PDF document text
    • https://cdn.sqhk.co/pinofizulag/Ljeak8i/spirit_run_gameplay.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4392647/normal_6027a937b25eb.pdfIn PDF document text
    • https://cdn.sqhk.co/penomufepuk/5ilUr7n/46348793583.pdfIn PDF document text
    • http://woxupepij.iblogger.org/83339904341.pdfIn PDF document text
    • https://cdn.sqhk.co/xekemini/FjbdAQV/badminton_league_mod_apk_hack_android_1.pdfIn PDF document text
    • http://zilomit.epizy.com/vidmate_install_apps.pdfIn PDF document text
    • https://s3.amazonaws.com/tugabijenovili/aimp_skins_pack_android.pdfIn PDF document text
    • http://zekuvosaletum.rf.gd/hubspot_social_media_marketing_certification_answers.pdfIn PDF document text
    • https://s3.amazonaws.com/ditiruz/uk_intelligence_and_security_committee_annual_report.pdfIn PDF document text
    • https://s3.amazonaws.com/zunewidimem/felomiriwufeb.pdfIn PDF document text
    • https://s3.amazonaws.com/lezerawe/swot_analysis_template_word.pdfIn PDF document text
    • https://s3.amazonaws.com/jadere/74114075109.pdfIn PDF document text
    • http://banitazivi.epizy.com/recover_deleted_text_messages_android_without_root.pdfIn PDF document text
    • http://dokubuxopid.rf.gd/5287190457.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.