PDF malware analysis — malicious · d9d83f23d65350c6

MALICIOUS

PDF

42.3 KB Created: 2020-12-31 18:43:19 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 3d20bf34a7be16e93e73dff182436aef SHA-1: 9d66a0f077b246daf951901f03bc4d1e0d10b7dd SHA-256: d9d83f23d65350c60c9a11e1fd1931abb21b49e80a470f704c372d9f7954ebe7

174 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF is identified as a phishing lure due to its small size, image-heavy content, and embedded clickable link. The heuristic 'PDF_IMAGE_LURE' indicates it's designed to trick users into clicking an action trigger. The presence of numerous external links, including one to 'trafficel.ru', suggests a malicious intent to redirect users to potentially harmful sites.

Machine Learning

Nyx PDF Classifier malicious score 0.7539

Heuristics 5

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE

PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 42 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://trafficel.ru/strik?utm_term=weather+nyc+celsius+yesterday
- https://tazuwadafif.weebly.com/uploads/1/3/4/8/134857375/wimurabofaverane.pdf
- https://bogadisosupotaj.weebly.com/uploads/1/3/0/7/130776541/nefinizisugevorogip.pdf
- https://delazodudiz.weebly.com/uploads/1/3/4/5/134591817/tidesopapusaj.pdf
- https://gekizunelim.weebly.com/uploads/1/3/4/8/134883517/dorew.pdf
- https://cdn.sqhk.co/nisosawero/gjjaP46/verizon_wireless_my_business_account_login.pdf
- https://s3.amazonaws.com/dudujopixejikug/vipumuziborafa.pdf
- https://s3.amazonaws.com/wazotojemov/club_penguin_rewritten_unblocked_download.pdf
- https://s3.amazonaws.com/bewibiwat/91807024835.pdf
- https://s3.amazonaws.com/gotenukevepunin/om_namo_narayanaya_chanting_audio_free.pdf
- https://s3.amazonaws.com/bepukuba/3_foot_ninja_unblocked_games.pdf
- https://s3.amazonaws.com/bidemewufa/netgear_orbi_beamforming_on_or_off.pdf
- https://s3.amazonaws.com/bulalowisu/81561800057.pdf
- https://s3.amazonaws.com/zirojopemup/calendario_completo_serie_a_19_20.pdf
- https://s3.amazonaws.com/sulasatevirexo/viweborefixikedegokusuwav.pdf
- https://uploads.strikinglycdn.com/files/e71504af-81c1-474b-bfda-6e083d4f007f/sports_gifts_for_boys_age_11.pdf
- https://s3.amazonaws.com/batiku/english_word_meaning_book.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.