PDF malware analysis — malicious · 1bb3e48bae52e537

MALICIOUS

PDF

49.7 KB Created: 2021-09-01 12:36:25 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-11

MD5: 2f23ad566cf998784b7831c3ad4db937 SHA-1: 30228c6b5e6731ae5efea6d61e520ef951a39ab5 SHA-256: 1bb3e48bae52e537255008be32f2b23d52c5ed328ae4b833962c1bb1c8a1c9d7

94 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The file was detected as a malicious PDF by ClamAV and an ML classifier. It contains an embedded URI pointing to a suspicious URL, which is likely used for phishing or to download a secondary payload. The PDF structure and embedded URLs suggest an attempt to lure the user to a malicious site.

Machine Learning

Nyx PDF Classifier malicious score 0.8649

Heuristics 3

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://cructi.ru/uplcv?utm_term=make+my+bed PDF link annotation
- http://comp-art.ru/userfiles/file/sozinesuzezifamiwekosago.pdfIn PDF document text
- https://cqc-material.com/app/webroot/userfiles/files/85647884485.pdfIn PDF document text
- https://goactive.hu/wp-content/plugins/super-forms/uploads/php/files/b83ebe771189ec7c45365a19bb8a69cd/pixixadewofotomaf.pdfIn PDF document text
- https://rhythmcprandfirstaid.com/wp-content/plugins/super-forms/uploads/php/files/cc89e7f3393cceceb8ce9c86d7983f41/14885733488.pdfIn PDF document text
- https://fullprotec.com/ckfinder/userIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.