PDF malware analysis — malicious · e6170df24c50adce

MALICIOUS

PDF

50.6 KB Created: 2020-11-25 12:12:22 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: cc4c7f542396c47a76944fe6a1766579 SHA-1: 0095185b0882aaf6d8e2643e0ab0ec0903874c3a SHA-256: e6170df24c50adceff819b1c8527a34f68c3e23d4a844b0b2765d3d955b674f7

174 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF file is identified as malicious by ClamAV and ML classifiers, and it employs an image-only lure typical of phishing attacks. It contains a clickable link disguised as an "Engineering guide" that redirects to a suspicious URL, likely to download a secondary payload or lead to a credential harvesting page. No scripts were extracted, but the PDF structure and embedded URIs strongly suggest a phishing campaign.

Machine Learning

Nyx PDF Classifier malicious score 0.7011

Heuristics 5

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE

PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 50 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://traffset.ru/aws?utm_term=engineering+guide+wow+legion
- https://tobosuxonekid.weebly.com/uploads/1/3/4/4/134493818/xumatifeton.pdf
- https://jeponiruwapin.weebly.com/uploads/1/3/0/7/130776483/7715375.pdf
- https://uploads.strikinglycdn.com/files/6b611e6f-d0d2-4b95-8a63-d3e8c836362c/zodelelexofakodonozavasa.pdf
- https://uploads.strikinglycdn.com/files/9b9d5aef-516d-4f8c-8376-9b318213556d/pizasutagafavotopo.pdf
- https://uploads.strikinglycdn.com/files/9e0733b8-dca2-4de2-8749-ba778393bed5/blade_dancer_lineage_of_light_psp.pdf
- https://uploads.strikinglycdn.com/files/d192e49f-b631-47ba-a0b2-dd3880479329/beginning_asp_net_mvc_4.pdf
- https://uploads.strikinglycdn.com/files/704aff91-75c2-40f4-8df4-59b6fe572627/kim_harrison_wikipedia.pdf
- https://s3.amazonaws.com/jagux/garuzisisedabibira.pdf
- https://uploads.strikinglycdn.com/files/6895ca8e-62e8-4840-89f3-294f90dc6f80/3840472858.pdf
- https://s3.amazonaws.com/dabatisew/funny_maths_questions_and_answers_in_english.pdf
- https://uploads.strikinglycdn.com/files/9e746c7b-5d4a-4ca9-81eb-71df88c6cc02/turning_point_usa_deadliest_virus.pdf
- https://uploads.strikinglycdn.com/files/91dd06c4-c228-40c6-b325-3ea58f853a2d/59033074886.pdf
- https://uploads.strikinglycdn.com/files/5c40ea01-8f76-43bd-ab01-fe9283176835/3102171822.pdf
- https://uploads.strikinglycdn.com/files/bf7156db-29d7-431b-9f7f-a30d8b0d8f2c/4511827227.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.