Malicious PDF — malware analysis report

Static analysis result for SHA-256 e7c3a41fda0220b4…

MALICIOUS

PDF

67.6 KB Created: 2020-12-13 22:04:10 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-27
MD5: 90887281b294719f7b3448c399bd2da3 SHA-1: 2b8d3cd8010b2764541e92f2dd286fcf655ff5fc SHA-256: e7c3a41fda0220b48204a570497ceeea15239dc1c737ac5d8c0e0ffd32452e62
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file contains a link to a known malicious redirector, indicating an attempt to lead the user to a harmful site. The ML classifier also flagged the document as malicious. While no scripts were extracted, the presence of a malicious URL within the document body strongly suggests a phishing or redirection attack.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7471

Heuristics 2

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffine.ru/aws?utm_term=altair+8800+user+manual In PDF document text
    • https://static.s123-cdn-static.com/uploads/4409093/normal_5fc533f728622.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4373985/normal_5fa745267ac76.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4389823/normal_5fba1d37b2c80.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4456165/normal_5fa8c80f14cb7.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4481068/normal_5fbdd21d9ef9f.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc2bd98403f5353fda1b0ca/t/5fcb76751880ce05e84b0a78/1607169653984/dezax.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/50f99d94-98ae-4a91-9ba9-b5038be91d0f/89606577162.pdfIn PDF document text
    • https://s3.amazonaws.com/jivamubug/subordinate_clauses_worksheet_ks2.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/60216e1f-6fed-4200-9cb1-abc923c4f1fe/altec_lansing_boom_jacket_manual.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/69829775-89c8-41fd-955d-c60e676fffb1/el_hotel_regis_fill_in_the_blanks_activity_textbook_instructions_label_the_floors_of_the_hotel.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.