PDF malware analysis — malicious · e1377d4f023e888a

MALICIOUS

PDF

54.6 KB Created: 2020-11-25 14:41:08 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 38fcc1e2d1a0c541aaa0fdb794937068 SHA-1: 4585bc55fd5405ade70fbfecc1fd1d1ad7c32152 SHA-256: e1377d4f023e888a2256d3361aca70d041b5ec497a06f40cd747b2bbfba152a3

152 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF contains a critical heuristic firing for a malicious redirector link pointing to 'gettraff.ru'. The ML classifier also flagged the document as malicious. While no scripts were extracted, the presence of a malicious URL strongly suggests an attempt to lure the user to a harmful site, likely for phishing or to download further malware.

Machine Learning

Nyx PDF Classifier malicious score 0.6294

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://gettraff.ru/aws?utm_term=christian+brothers+songs
- https://cdn-cms.f-static.net/uploads/4394071/normal_5faa7291c2037.pdf
- https://cdn-cms.f-static.net/uploads/4450160/normal_5fa6cdec562e7.pdf
- https://cdn-cms.f-static.net/uploads/4401703/normal_5fa81fa7e2c47.pdf
- https://s3.amazonaws.com/bovenotojitowe/tagadawuzujanarip.pdf
- https://s3.amazonaws.com/wixanarer/goat_cartoon_photos.pdf
- https://s3.amazonaws.com/wusone/gotol.pdf
- https://uploads.strikinglycdn.com/files/9354f64c-55f1-4edd-87e4-2ad977459e57/subnautica_how_to_use_alien_containment.pdf
- https://s3.amazonaws.com/fufaragebo/geometry_similar_right_triangles_worksheet_answers.pdf
- https://s3.amazonaws.com/dejazuvorira/bharat_ka_naksha_karen.pdf
- https://uploads.strikinglycdn.com/files/34b2035b-2087-49e9-99e4-743332d9f553/tumomidibabotatekikimato.pdf
- https://uploads.strikinglycdn.com/files/bb2a2a16-1486-4269-8b00-1f69c461a0d1/mozaxumasunedogo.pdf
- https://s3.amazonaws.com/sukedil/kajelekijawokulujop.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.