PDF malware analysis — malicious · d9785d05a13cb483

MALICIOUS

PDF

29.1 KB Created: 2020-11-01 03:31:53 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: cd9388f11e7b2bb31f7cdaca81c368f4 SHA-1: 249bf608cdb4432469f11a1b47725fef326b36dd SHA-256: d9785d05a13cb483cd4d6575ba0e56602c7c30fbeface44943c8b3ea7e2e253e

172 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF is identified as a malicious redirector link and an image-only lure, typical of phishing campaigns. It contains numerous external links, including a primary malicious URL that leads to a redirector. The document body contains garbled text but also includes the primary malicious URL, suggesting an attempt to disguise the malicious content.

Machine Learning

Nyx PDF Classifier malicious score 0.9979

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE

PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 29 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ggtraff.ru/strik?keyword=asu+villas+at+vista+parking+garage
- https://gefelamanak.weebly.com/uploads/1/3/4/3/134353999/24523a9dfa383.pdf
- https://ruvazokof.weebly.com/uploads/1/3/4/0/134040659/jawuvilevifubatag.pdf
- https://wijisozafepu.weebly.com/uploads/1/3/4/3/134356417/87c5de2.pdf
- https://s3.amazonaws.com/xanebavifamopez/pezogavefaki.pdf
- https://uploads.strikinglycdn.com/files/62f0c240-3b7c-44e1-a1cf-ac466e3bd6c8/harry_potter_tome_4.pdf
- https://uploads.strikinglycdn.com/files/c8f9306a-cd79-4a3f-9bfd-5cbaa035fc5d/lake_highlands_high_school_yearbook.pdf
- https://uploads.strikinglycdn.com/files/321c1be8-bf69-4083-84de-ec8f859d7f4b/45561907663.pdf
- https://s3.amazonaws.com/sivanira/coc_hack_download_2018.pdf
- https://s3.amazonaws.com/voxulija/salarakalogasavekovitij.pdf
- https://s3.amazonaws.com/sugaguxagu/regulation_of_cancer_cell_metabolism.pdf
- https://s3.amazonaws.com/gavexilatuvitaz/12206645683.pdf
- https://uploads.strikinglycdn.com/files/e8829c85-eb07-46f6-999c-0cfe939387fe/28850626176.pdf
- https://uploads.strikinglycdn.com/files/c944043d-f918-4309-abab-b4c1f8195093/66024354288.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.