PDF malware analysis — malicious · e658f4c93e4e7c42

MALICIOUS

PDF

58.3 KB Created: 2020-12-04 18:36:07 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: c964384f93f3073f32cd8e822d6d9221 SHA-1: 08c16732d4766933c573818f5a200d0871616e33 SHA-256: e658f4c93e4e7c425cb410bc4c5388efe16abd94e1a8a790352deb23b5775685

232 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.001 User Execution: Malicious Link

The PDF is identified as a phishing lure due to its image-only nature and a clickable action. It contains a critical PDF_MALICIOUS_REDIRECTOR_LINK heuristic firing, pointing to the URL https://ggtraff.ru/strik?utm_term=midnight+express+wrestling+hall+of+fame, which is known malicious infrastructure. The ClamAV detection and ML classifier further support its malicious classification.

Machine Learning

Nyx PDF Classifier malicious score 0.7162

Heuristics 5

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE

PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 58 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ggtraff.ru/strik?utm_term=midnight+express+wrestling+hall+of+fame
- https://vilomaranetuxer.weebly.com/uploads/1/3/4/5/134502128/suxilisila-buwolasilomof-pefedimu.pdf
- https://petugureb.weebly.com/uploads/1/3/4/4/134445868/8856474.pdf
- https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbdf726f8cdb769c6a8efe3/1606285094591/primary_spelling_inventory_grade_level.pdf
- https://uploads.strikinglycdn.com/files/c23fdd5e-e3d4-4071-b991-b4215564eebe/valores_corporativos_de_una_tienda_de_abarrotes.pdf
- https://s3.amazonaws.com/miwolezedubujoz/beach_buggy_blitz_mod_apk_unlimited_money.pdf
- https://s3.amazonaws.com/vitelitubovuluj/pen_test_report.pdf
- https://static1.squarespace.com/static/5fc0ed17f7cf8c75402b0ccf/t/5fc10bf21972c46e3cc3817a/1606487026715/tozesakifawetetuj.pdf
- https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbf519c1972c46e3c958115/1606373790167/xifibawijuta.pdf
- https://static1.squarespace.com/static/5fc4c1dc0b6b03258f4e1bb4/t/5fc568eb6457125654f299bf/1606772972034/dapozufoxefukizovasen.pdf
- https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbcf2f52c6de34c7a37e93e/1606218486749/case_files_obgyn_5th_edition_free.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.