PDF malware analysis — malicious · f7aafc1b9a3685c3

MALICIOUS

PDF

66.6 KB Created: 2020-11-09 12:58:01 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: ffd6e82f7c18222623b93faddcd814a8 SHA-1: 06b3202d7f1a2f6129e2d5f67cb8490cf535ac78 SHA-256: f7aafc1b9a3685c38a183feb8d4ee54ce7dab0b1b10620cd707fb6e2d945447c

62 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF file contains a link to a known malicious redirector, which is likely intended to lead the user to a malicious website. The document body, though heavily obfuscated, contains text related to 'Windows port listing', suggesting a lure. No scripts were extracted, but the presence of a malicious URL is a strong indicator of a phishing or redirection attempt.

Machine Learning

Nyx PDF Classifier clean score 0.0677

Heuristics 2

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL https://cctraff.ru/aws?keyword=windows+port+listing

Open this report in the interactive analyzer, or submit your own file for analysis.