PDF malware analysis — malicious · d9f5d775350fa3c2

MALICIOUS

PDF

24.6 KB Created: 2020-10-29 18:56:19 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 0dda701828e6c438ca6644fe01a06762 SHA-1: 3d6a4acc71e75701018e5942926afdf93cee7203 SHA-256: d9f5d775350fa3c2613f25aaf8b19cbf0bdd2b666fae6a5aaa30c5aca917d0a6

112 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

This PDF document is designed as an image-based lure, presenting a screenshot to trick users into interacting with a malicious link. The embedded URL, https://ggtraff.ru/aws?keyword=sandisk+sansa+e250+manual, is flagged as a known malicious redirector, indicating it likely leads to a phishing or malware distribution site. The ML classifier also strongly flagged this PDF as malicious.

Machine Learning

Nyx PDF Classifier malicious score 0.9961

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE

PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 24 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ggtraff.ru/aws?keyword=sandisk+sansa+e250+manual
- https://tuzuwopibas.weebly.com/uploads/1/3/4/3/134316447/wonidovisixor_vetuxomakolefu_befarop_kiranexajuvuw.pdf
- https://pezopipowom.weebly.com/uploads/1/3/1/4/131406060/navukezekuxuvunasi.pdf
- https://pepisukuwen.weebly.com/uploads/1/3/1/6/131606293/vizag.pdf
- https://godadonalizubo.weebly.com/uploads/1/3/1/4/131437317/lubumepa.pdf
- https://cdn-cms.f-static.net/uploads/4384821/normal_5f938d16e68ff.pdf
- https://cdn-cms.f-static.net/uploads/4384832/normal_5f90824827cea.pdf
- https://cdn-cms.f-static.net/uploads/4388038/normal_5f9478427c9a4.pdf
- https://cdn-cms.f-static.net/uploads/4374689/normal_5f890b063109c.pdf
- https://cdn-cms.f-static.net/uploads/4369330/normal_5f9182d5ae07d.pdf
- https://damijuvik.weebly.com/uploads/1/3/1/3/131381376/5069218.pdf
- https://s3.amazonaws.com/susopuzupure/50845538636.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.