PDF malware analysis — malicious · f30b3fc1fb593fb5

MALICIOUS

PDF

49.6 KB Created: 2021-01-12 13:11:34 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: a55cd91187232c5acfd77c2d93813e0a SHA-1: 05b177038b71640d26e1c46ad88026d11136bbc8 SHA-256: f30b3fc1fb593fb54fb1d1b36723fcf914193290a7cd4bcc00183c02135e9d62

182 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF file contains multiple embedded links that redirect to known malicious infrastructure, as indicated by the PDF_MALICIOUS_REDIRECTOR_LINK heuristic. The ML classifier and ClamAV also flagged this file as malicious. The presence of these links suggests an attempt to phish users or direct them to malware-hosting sites.

Machine Learning

Nyx PDF Classifier malicious score 0.7482

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ggtraff.ru/aws?utm_term=watchos+6+public+beta
- https://kasadinup.weebly.com/uploads/1/3/4/6/134641165/nolodo-pazoke-xiluvogubi.pdf
- https://tenetowebobidiv.weebly.com/uploads/1/3/4/6/134635535/tupig_bajuloxapug.pdf
- https://lefazevi.weebly.com/uploads/1/3/0/8/130873710/d0ca986e4e42.pdf
- https://gitojigobireko.weebly.com/uploads/1/3/4/5/134517815/tunenifisudi-minunavel-joziz-xatidafigusoxe.pdf
- https://tekegalesi.weebly.com/uploads/1/3/0/7/130740489/wezuwowotosela_fowonebej.pdf
- https://site-1166616.mozfiles.com/files/1166616/80178366390.pdf
- https://palifeselaliku.weebly.com/uploads/1/3/4/4/134441248/waseva.pdf
- https://s3.amazonaws.com/nufidibodudulad/antigeno_19-_9.pdf
- https://s3.amazonaws.com/womirofop/reciprocal_pronouns_exercises_with_answers.pdf
- https://s3.amazonaws.com/nuxulikiwab/mipetafelarapofoxiji.pdf
- https://s3.amazonaws.com/fumiposamisur/informe_de_auditoria_externa_iso_9001.pdf
- https://s3.amazonaws.com/retisovojor/american_football_uniform_creator.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.