PDF malware analysis — malicious · d075bbe2bc3110ee

MALICIOUS

PDF

49.6 KB Created: 2020-11-30 21:54:39 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: a011afd98476184922d7d271c9fdd538 SHA-1: ddff0b3a5e788ebd106af11ecf7d942c1c28d535 SHA-256: d075bbe2bc3110eec36114b381a5d67fe41031d01b4ce6ffb9dbb5286d52d2ef

172 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious Link

This PDF file is identified as malicious due to its structure and embedded link. It functions as an image-based lure, presenting a screenshot to conceal a clickable link. The primary malicious indicator is the embedded URL, which directs to known malicious redirector infrastructure, suggesting an attempt to phish credentials or deliver further malware.

Machine Learning

Nyx PDF Classifier malicious score 0.6502

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE

PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 49 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://traffmen.ru/strik?utm_term=object+oriented+programming+java+best+book
- https://putigazabikikim.weebly.com/uploads/1/3/2/6/132682718/6601931.pdf
- https://lalidusuferub.weebly.com/uploads/1/3/4/4/134440540/18ff40ffc6f2.pdf
- https://s3.amazonaws.com/rufonali/29267522604.pdf
- https://s3.amazonaws.com/kaxukok/82594102477.pdf
- https://uploads.strikinglycdn.com/files/e7c3b3ea-b822-4ef5-a1b7-1d011b81e58d/nidavelunapagisogususegep.pdf
- https://s3.amazonaws.com/liwafo/utilitarianism_vs_deontology.pdf
- https://uploads.strikinglycdn.com/files/52cb849a-2bba-4c63-b8ec-5d3c31fb6528/relieving_letter_hr.pdf
- https://uploads.strikinglycdn.com/files/da46f876-b830-47c5-a3c9-7175d5c4fdab/38782712418.pdf
- https://s3.amazonaws.com/fomudebipefasu/men_s_style_guide_casual_shoes.pdf
- https://uploads.strikinglycdn.com/files/e53310e5-d6a5-481d-b430-86c96d2389d7/gba_files_pokemon.pdf
- https://s3.amazonaws.com/xafaxotaful/fivuborejaxuvilurogumone.pdf
- https://uploads.strikinglycdn.com/files/c3e480ee-ab23-47d6-b90d-95dac5803380/kirizesipaxunusow.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.