PDF malware analysis — malicious · ea84706cd8cc4f56

MALICIOUS

PDF

16.0 KB Created: 2020-11-04 16:15:44 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 26a449a07e6cdbd923eeffee8253aad3 SHA-1: f169723f9c96c715317d2f3b96ce6a381ef46c1a SHA-256: ea84706cd8cc4f5609bf2df67fbc2e47a1148bd025b268632eb5c38c91dfef54

112 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF is identified as an image-only lure, containing a clickable link that redirects to known malicious infrastructure. The heuristic 'PDF_MALICIOUS_REDIRECTOR_LINK' specifically flags the URL 'https://ggtraff.ru/strik?keyword=baidu+root+english+apk' as malicious. This suggests the document's primary purpose is to redirect the user to a harmful site, likely for phishing or to download further malware.

Machine Learning

Nyx PDF Classifier malicious score 0.9951

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE

PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 16 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ggtraff.ru/strik?keyword=baidu+root+english+apk
- https://bubixoduxufito.weebly.com/uploads/1/3/1/0/131070588/dopogegulagurose.pdf
- https://kobetuditi.weebly.com/uploads/1/3/4/4/134446504/4989440.pdf
- https://gikigafe.weebly.com/uploads/1/3/4/4/134440869/8977032.pdf
- https://wevinavuligi.weebly.com/uploads/1/3/4/5/134505150/gujizujoxizodo-tewofomik.pdf
- https://dimaxafazeza.weebly.com/uploads/1/3/1/4/131453031/08cd6.pdf
- https://s3.amazonaws.com/jutenojamega/eths_bell_schedule_2020.pdf
- https://uploads.strikinglycdn.com/files/68aa2bb4-56ec-43cd-8bb2-c09000b14c94/39699469085.pdf
- https://s3.amazonaws.com/mamukawaxatali/skylanders_trap_team_traps_8_pack.pdf
- https://s3.amazonaws.com/sugaguxagu/41442215579.pdf
- https://s3.amazonaws.com/felasorarabipis/94623775825.pdf
- https://s3.amazonaws.com/mudurixo/36782284299.pdf
- https://uploads.strikinglycdn.com/files/db038036-1fbb-4dc9-961d-39b9c0eae849/nonivogurukewivibom.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.