PDF malware analysis — malicious · 030ec9535ceb1066

MALICIOUS

PDF

50.6 KB Created: 2020-11-23 13:01:46 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 659f492e658931dffcf110edea5a7254 SHA-1: 2ccf280399e0ad337aa66915ed86b1edcbe89291 SHA-256: 030ec9535ceb10663d322fac3c7f83b557079ee38ebebffc801c387d0605e5d2

94 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The file is identified as malicious by multiple heuristics, including ML classification and ClamAV, which specifically flags it as a Pdf.Phishing.Trojan. The embedded URL `https://traffset.ru/aws?utm_term=wows+yamato+guide` is a strong indicator of a phishing or malware distribution attempt. Although no scripts were explicitly extracted, the PDF structure and the presence of external URIs suggest an attempt to redirect the user to a malicious site, likely as part of a spearphishing campaign.

Machine Learning

Nyx PDF Classifier malicious score 0.6781

Heuristics 3

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://traffset.ru/aws?utm_term=wows+yamato+guide
- https://cdn-cms.f-static.net/uploads/4445882/normal_5fbb77e49339a.pdf
- https://cdn-cms.f-static.net/uploads/4459629/normal_5fa67d6e05945.pdf
- https://cdn-cms.f-static.net/uploads/4387807/normal_5f9e4ab6c649b.pdf
- https://s3.amazonaws.com/lewuli/politikin_zabavnik_stripovi.pdf
- https://s3.amazonaws.com/susopuzupure/android_studio_tutorialspoint.pdf
- https://s3.amazonaws.com/sixenogafopoj/perfectly_inelastic_demand_curve_is_vertical.pdf
- https://s3.amazonaws.com/mamukawaxatali/pokemon_go_gotcha_manual.pdf
- https://uploads.strikinglycdn.com/files/607b672e-be76-49ce-a9d1-c092e34eb6c2/5801469749.pdf
- https://s3.amazonaws.com/mexavofezoxi/pryor_junior_high_school_pryor_ok.pdf
- https://s3.amazonaws.com/wexoteluwag/kirum.pdf
- https://s3.amazonaws.com/welanisowari/the_jungle_quotes_by_chapter.pdf
- https://s3.amazonaws.com/buganabowumujef/34317511715.pdf
- https://s3.amazonaws.com/wesezuzuvalirik/fikata.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.