PDF malware analysis — malicious · e2542b0230573227

MALICIOUS

PDF

75.7 KB Created: 2021-05-19 00:01:26 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-24

MD5: 064b46d4e9c656738c7c4684a22a3d2a SHA-1: 95079af9eaf7ff35e9aa094abf385af65914dc3a SHA-256: e2542b0230573227f7e4453876378e48c501ef8e7a8c074609caa2f1c8e97d83

122 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF contains a critical heuristic firing indicating a malicious redirector link to 'crophysi.ru'. ClamAV also detected the file as a phishing trojan. While no scripts were extracted, the presence of a malicious URL strongly suggests an attempt to lure the user to a compromised site, likely for credential harvesting or further malware delivery.

Machine Learning

Nyx PDF Classifier suspicious score 0.4300

Heuristics 3

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://crophysi.ru/strik?utm_term=printable+vinyl+paper+walmart In PDF document text
- https://static.s123-cdn-static.com/uploads/4495846/normal_600213fcf41c2.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4403683/normal_6046030ad8294.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/23c79c3e-b9e0-40e0-a630-ac61fd4fbf5f/86900203897.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.