PDF malware analysis — malicious · 10329e9f5dc239ce

MALICIOUS

PDF

50.6 KB Created: 2020-11-13 02:39:58 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 89f81d29cd357f6814d5124422d93caf SHA-1: d96e21d7a052e82d7d9402ca9d342cb0c2203406 SHA-256: 10329e9f5dc239ceeda5b8cb4844e14778e7fae01b0b988fd3731c756d80cb62

94 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The file is a PDF document identified as malicious by ClamAV and an ML classifier. It contains an embedded URI pointing to 'trafftec.ru', which is likely a phishing or malware distribution site. The document body, though heavily obfuscated, suggests a lure related to downloading software, aligning with a phishing attack pattern.

Machine Learning

Nyx PDF Classifier malicious score 0.5258

Heuristics 3

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://trafftec.ru/strik?utm_term=download+smart+pss+windows+10+64+bit
- https://fosapiluni.weebly.com/uploads/1/3/4/6/134653401/gojidajinopa.pdf
- https://zazuxari.weebly.com/uploads/1/3/4/3/134319397/tifawit_vedexel.pdf
- https://genigudepa.weebly.com/uploads/1/3/1/0/131070712/runemevurexuziwone.pdf
- https://uploads.strikinglycdn.com/files/2803fa2a-ba08-491c-bb4c-837252dd8d12/lotogababuferosebu.pdf
- https://uploads.strikinglycdn.com/files/90a3430a-f666-4561-98d5-09c88c49b829/italian_nursery_ryhmes.pdf
- https://uploads.strikinglycdn.com/files/a9f670c2-ca6e-40c7-be97-500577cb8f91/kuwereni.pdf
- https://s3.amazonaws.com/medetopuwofetut/burke_williams_gift_card_amount.pdf
- https://uploads.strikinglycdn.com/files/e9576907-1116-42ee-a522-db78d7bd1812/96219922532.pdf
- https://s3.amazonaws.com/gonuxiwela/real_steel_world_robot_boxing_apk_hack_free_download.pdf
- https://uploads.strikinglycdn.com/files/4ffeb4a3-0339-4e9e-a192-399588f92fa7/53116033131.pdf
- https://s3.amazonaws.com/lorifumofelu/10489799588.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.