PDF malware analysis — malicious · f0f823e1f86b25b2

MALICIOUS

PDF

50.6 KB Created: 2020-12-04 11:05:01 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: d334618ba26abb352249c2afa6351ac2 SHA-1: d25dbe372875bcb8e4d5bf17a6a0c6d13c1cd388 SHA-256: f0f823e1f86b25b27c2be8692c36e32469af54aa50bd8227d8c18dc5dde540dd

152 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF contains a link that redirects to known malicious infrastructure, as indicated by the PDF_MALICIOUS_REDIRECTOR_LINK heuristic. The ML classifier also flagged the document as malicious. Although the document body is heavily obfuscated, the presence of a malicious redirector strongly suggests a phishing or credential harvesting attempt, likely delivered as a spearphishing attachment.

Machine Learning

Nyx PDF Classifier malicious score 0.7532

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://gettraff.ru/aws?utm_term=devops+cv+template
- https://cdn-cms.f-static.net/uploads/4383921/normal_5f8e66990b22d.pdf
- https://cdn-cms.f-static.net/uploads/4382973/normal_5f918cb5dc007.pdf
- https://cdn-cms.f-static.net/uploads/4378410/normal_5f8a11a96aa80.pdf
- https://cdn-cms.f-static.net/uploads/4375716/normal_5f90cc19f1533.pdf
- https://cdn-cms.f-static.net/uploads/4412889/normal_5fa974abb25ca.pdf
- https://ranerenonosojib.weebly.com/uploads/1/3/1/4/131483420/wajibe-wixud.pdf
- https://cdn-cms.f-static.net/uploads/4389104/normal_5f906a9f5531e.pdf
- https://kelutatu.weebly.com/uploads/1/3/4/5/134521402/ffb828cbd4e52.pdf
- https://static1.squarespace.com/static/5fc6fe7f54d69c596232e783/t/5fc84904094cf7617dbb9f82/1606961413281/90123425554.pdf
- https://static1.squarespace.com/static/5fc34e1bf9866f3fd2e3a1df/t/5fc6b558bfb90028be37790a/1606858072847/56053745862.pdf
- https://static1.squarespace.com/static/5fc167576609fd0ee794de9f/t/5fc75f72a038a451bcec8d3d/1606901619062/puvotikakudajupodukoti.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.