PDF malware analysis — malicious · d55d9499c5ab6347

MALICIOUS

PDF

62.3 KB Created: 2021-04-02 18:42:40 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-08-25

MD5: 622d62bb9405d886aa1267266e07cdf0 SHA-1: b49020661758c470aa2956ac299baba855dcc853 SHA-256: d55d9499c5ab63475c198a6f57820b578a3ad499d45438dfafdb49195eee4e9f

134 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ClamAV and an ML classifier. It contains a lure related to car tyre repair, directing users to a suspicious URL (https://bologen.ru/strik?utm_term=car+tyre+repair+near+me+open+sunday) which is flagged as an SEO redirector for phishing. While no scripts were explicitly extracted, the PDF structure and embedded URLs suggest an attempt to lead the user to a malicious site, likely for credential harvesting or further malware delivery.

Machine Learning

Nyx PDF Classifier malicious score 0.6276

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK

PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://bologen.ru/strik?utm_term=car+tyre+repair+near+me+open+sunday PDF link annotation
- http://wodekenizowa.getenjoyment.net/17510687482.pdfIn PDF document text
- http://kimisorunutom.medianewsonline.com/belzona_1311.pdfIn PDF document text
- http://hookup157.online/zitodaxevosimapovapazekuzk6l57.pdfIn PDF document text
- http://rulogojaratimad.22web.org/grading_sheet_deped_tambayan.pdfIn PDF document text
- http://form-lnstagramverificationbadge.com/xepexudopijomulisekanozyzjtf.pdfIn PDF document text
- http://nizavevorupuj.mywebcommunity.org/57403286161.pdfIn PDF document text
- http://constructionhouse.info/stars_live_wallpaper_picker_apkpurenvgcc.pdfIn PDF document text
- http://vigirorimikana.medianewsonline.com/lng_bunkering_procedure.pdfIn PDF document text
- http://fawikenaxalu.scienceontheweb.net/mufutemazisonakipo.pdfIn PDF document text
- https://s3.amazonaws.com/nafibanefexex/bexal.pdfIn PDF document text
- http://nabotiwufonego.epizy.com/pupcet_admission_form.pdfIn PDF document text
- https://s3.amazonaws.com/dinigugaxej/zelubexudiredojodolij.pdfIn PDF document text
- http://danetuxu.rf.gd/piping_isometric_drawing_book.pdfIn PDF document text
- https://s3.amazonaws.com/tobobowu/how_to_plant_loose_leaf_lettuce_seeds.pdfIn PDF document text
- http://vigexosav.myartsonline.com/60857302969.pdfIn PDF document text
- http://tidusuf.rf.gd/bracket_html_editor.pdfIn PDF document text
- https://s3.amazonaws.com/sowewazulejewi/47765296038.pdfIn PDF document text
- https://s3.amazonaws.com/risisipajole/detugarivebuvedoxezodux.pdfIn PDF document text
- https://s3.amazonaws.com/likerajatob/70660656149.pdfIn PDF document text
- https://s3.amazonaws.com/xovekolamoxe/welof.pdfIn PDF document text
- https://s3.amazonaws.com/rikolesafuwofar/zizulenosudisaremuv.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.