PDF malware analysis — malicious · 27758f362699df6a

MALICIOUS

PDF

102.7 KB Created: 2021-07-02 04:51:04 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-12

MD5: 6f8ec1b266c3a89cb12babeb96fa9203 SHA-1: da7c61d975275202bf02bb204924a67dca48d956 SHA-256: 27758f362699df6afec539e6013ab21d5345d98b0b5d5a52751495948df14dc5

94 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The file was detected as malicious by ML classifiers and ClamAV, specifically identified as a phishing trojan. Although no document body text was available for analysis, the presence of embedded URLs and the PDF structure suggest an attempt to redirect users to potentially harmful sites. The heuristic firings indicate the file's malicious nature and its association with phishing tactics.

Machine Learning

Nyx PDF Classifier malicious score 0.7924

Heuristics 3

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://www.ogblfrontaliers.fr/wp-content/plugins/super-forms/uploads/php/files/jmfvpp543nmg9opo7rg5s5u1kd/79898793234.pdf In PDF document text
- https://nullemont.fr/nullemont/ckfinder/userfiles/files/taxipin.pdfIn PDF document text
- https://mamadona.ru/ckfinder/userfiles/files/jigowomasefitolabev.pdfIn PDF document text
- https://feedproxy.google.com/~r/skout/mBVl/~3/BvfzZFkJO3s/uplcv?utm_term=history+of+zero+in+maths+for+projectPDF link annotation

Open this report in the interactive analyzer, or submit your own file for analysis.