PDF malware analysis — malicious · 0e124840718f0d92

MALICIOUS

PDF

186.6 KB Created: 2020-11-18 03:51:14 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-27

MD5: ea9279bf77e292870812e410ccd72bc8 SHA-1: f2be6be8e28788401c3abbbf04aca99ae6550767 SHA-256: 0e124840718f0d92bf8ffcb5e6160f133f59c50cf660681d4a09ae5c18eb12ce

94 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The file is a PDF document that contains an embedded URL. The ML classifier and ClamAV detection strongly indicate malicious intent, likely for phishing or malware distribution. The embedded URL points to a suspicious domain, suggesting it's used to redirect the user to a malicious site.

Machine Learning

Nyx PDF Classifier malicious score 0.9886

Heuristics 3

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://trafffi.ru/aws?utm_term=idsa+guidelines+cellulitis+abscess PDF link annotation
- https://cdn-cms.f-static.net/uploads/4366645/normal_5f8e60bfd3f51.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4384468/normal_5f8cbc0eb6af7.pdfIn PDF document text
- https://tatogupuragafa.weebly.com/uploads/1/3/4/0/134096405/6239888.pdfIn PDF document text
- https://tazeviguso.weebly.com/uploads/1/3/4/3/134339516/gemelupuka_jaxizisaw_mumudixiwofa.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4385634/normal_5fa12b3b425a3.pdfIn PDF document text
- https://s3.amazonaws.com/widiku/67217355120.pdfIn PDF document text
- https://s3.amazonaws.com/poresi/biwivutowebalupebarorod.pdfIn PDF document text
- https://s3.amazonaws.com/ditiruz/albino_luciani_illustrissimi.pdfIn PDF document text
- https://s3.amazonaws.com/vokeri/mitch_albom_first_phone_call_from_heaven.pdfIn PDF document text
- https://s3.amazonaws.com/xarojapi/31738930667.pdfIn PDF document text
- https://s3.amazonaws.com/felasorarabipis/webokebazifixasevuzisi.pdfIn PDF document text
- https://s3.amazonaws.com/ritoma/descriptive_essay_samples_free.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.