PDF malware analysis — malicious · f38c28443eaa00cb

MALICIOUS

PDF

64.0 KB Created: 2021-04-01 23:18:02 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-08-20

MD5: 61dca318ba06d3602481763bcb4ab3cf SHA-1: 51ae0fb15373a5e63ad055056a315f6bc034ddb0 SHA-256: f38c28443eaa00cb581263c4e0491038e1ffdbd0034921e2f7831be74508dfb3

134 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF file contains a heuristic indicating it's a lure for free downloads, directing users to an external URL. This URL is likely part of a phishing or malware distribution scheme. The ClamAV detection further supports the malicious nature of the file.

Machine Learning

Nyx PDF Classifier malicious score 0.6428

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK

PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://mezovuduw.ru/strik?utm_term=where+is+the+unloader+valve+on+my+pressure+washer PDF link annotation
- http://pagebake.com/how_to_use_garmin_78_gps_handheldksnbi.pdfIn PDF document text
- http://ag-management.space/white_chicks_free_onlinevt8h0.pdfIn PDF document text
- http://the-job.ru/niramifusovanen4mz46.pdfIn PDF document text
- http://badge-verification-center.com/zipodifuzuturiwilazkgaw0.pdfIn PDF document text
- http://xbet1.fun/44910301328qgw2x.pdfIn PDF document text
- http://fosipuzo.mypressonline.com/sokibupunoloxijez.pdfIn PDF document text
- http://tudixuzaw.onlinewebshop.net/sanimakatek.pdfIn PDF document text
- https://s3.amazonaws.com/lanubili/jorowivawodelorolunuj.pdfIn PDF document text
- https://s3.amazonaws.com/ruzumeb/magento_2_get_email_template_id.pdfIn PDF document text
- https://s3.amazonaws.com/zafirawit/lijex.pdfIn PDF document text
- https://s3.amazonaws.com/wovisak/jemuruvuxigexifudasanaxew.pdfIn PDF document text
- https://s3.amazonaws.com/wiwuxot/how_to_use_prid_drawing_salve_for_boils.pdfIn PDF document text
- https://s3.amazonaws.com/fuvidokibet/23218760267.pdfIn PDF document text
- https://s3.amazonaws.com/batoragubukepo/63263243392.pdfIn PDF document text
- https://s3.amazonaws.com/nonipesikiri/6013716356.pdfIn PDF document text
- https://s3.amazonaws.com/pirosisob/bikimujoxim.pdfIn PDF document text
- https://s3.amazonaws.com/turip/vovomi.pdfIn PDF document text
- https://s3.amazonaws.com/lanorolowu/nccn_guidelines_rectal_cancer_2017.pdfIn PDF document text
- https://s3.amazonaws.com/vexeliku/distorsi_informasi_dan_bullwhip_effect.pdfIn PDF document text
- https://s3.amazonaws.com/dakebesuvum/2317220017.pdfIn PDF document text
- https://s3.amazonaws.com/radubozufiwo/blaming_the_victim_ryan.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.

PDF

Malware Insights

Machine Learning

Heuristics 4

Related samples 6