PDF malware analysis — malicious · 0ab92552c1804d0c

MALICIOUS

PDF

41.6 KB Created: 2020-11-20 11:20:57 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: fc8bfc8d44e39887e2d56fcec16c4c2c SHA-1: a1076390553b0a7f8664cfba177efe3853d7d846 SHA-256: 0ab92552c1804d0c31e68296f08eec24e7a949a58c67c384c7d4b48b1ed05a9e

114 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

This PDF document is identified as malicious by ClamAV and an ML classifier. It employs a common phishing tactic by presenting itself as an image-based lure, likely a screenshot, to entice users to click on an embedded URI. The primary malicious indicator is the external URI pointing to 'traffking.ru', which is likely used to host a phishing page or deliver a secondary payload.

Machine Learning

Nyx PDF Classifier malicious score 0.9544

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE

PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 41 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://traffking.ru/aws?utm_term=periodic+table+coloring+activity+worksheet+pdf
- https://uploads.strikinglycdn.com/files/5b48e180-6dc2-40ec-9ce9-7d4329024f9c/vogudifomotejozowukizaf.pdf
- https://uploads.strikinglycdn.com/files/f01122dd-9878-4983-b769-2ba614a6e183/2002_honda_civic_lx_owners_manual.pdf
- https://uploads.strikinglycdn.com/files/fb40e599-085f-4f00-a2d5-7db5e259c85f/lesifotemerigi.pdf
- https://uploads.strikinglycdn.com/files/5bef2dd5-c925-4a1f-9076-3f6b407e6764/vunusejoz.pdf
- https://uploads.strikinglycdn.com/files/d76e9173-f839-4afe-a010-10ef44450f57/shellac_nails_and_lashes.pdf
- https://uploads.strikinglycdn.com/files/51ee478f-bfcc-4441-bf0a-aedad630c283/angry_video_game_nerd_sonic_06.pdf
- https://uploads.strikinglycdn.com/files/cd38bd38-efb9-4994-ab10-9f5325d0770a/fuzugotonabopexitu.pdf
- https://uploads.strikinglycdn.com/files/47459c92-449e-4018-8e16-0bb97cb46514/16782875246.pdf
- https://uploads.strikinglycdn.com/files/161927f4-2a0c-4a48-a11f-30eea1ae3d33/20101163300.pdf
- https://uploads.strikinglycdn.com/files/e560c669-8b94-49e9-8dda-6a7157c3619c/free_showbox_movies_online_app_download.pdf
- https://uploads.strikinglycdn.com/files/b81dacbb-8b43-4901-af55-0be08c43e3f3/borefinoderufazawe.pdf
- https://uploads.strikinglycdn.com/files/ba3fc250-aee4-4dad-82ec-4dcfe4251935/28010922706.pdf
- https://uploads.strikinglycdn.com/files/2b07ba32-10b9-4b91-94bc-3055b3530345/73661761043.pdf
- https://uploads.strikinglycdn.com/files/099ef5a9-5385-4e81-a11e-9f7f9f148d65/wixijamakin.pdf
- https://uploads.strikinglycdn.com/files/a0f54cb7-7f92-4692-a273-eaafd7748964/92616540052.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.