PDF malware analysis — malicious · 3623f6baf14e4eb2

MALICIOUS

PDF

41.4 KB Created: 2020-11-27 04:34:20 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 94a87bc21408f8cecceedd4bc8d89826 SHA-1: 14a95bd2b45db65a4ab8a6c3e88831188d01acad SHA-256: 3623f6baf14e4eb24c94acfff6338ee718ace52442efc59cbee2c2ca1f52fd9b

114 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

This PDF document is identified as malicious by ClamAV and an ML classifier. It employs a screenshot lure, a common tactic for phishing or malware distribution. The embedded URL, https://trafffe.ru/aws?utm_term=hemodialysis+access+guidelines, is the primary indicator of malicious intent, likely serving as a redirect to a malicious site.

Machine Learning

Nyx PDF Classifier malicious score 0.6184

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE

PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 41 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://trafffe.ru/aws?utm_term=hemodialysis+access+guidelines
- https://cdn-cms.f-static.net/uploads/4366020/normal_5f89837aa00ed.pdf
- https://cdn-cms.f-static.net/uploads/4417329/normal_5f9d29076ee68.pdf
- https://cdn-cms.f-static.net/uploads/4368486/normal_5f8890f967ba3.pdf
- https://cdn-cms.f-static.net/uploads/4381978/normal_5f9f393b57ac6.pdf
- https://cdn-cms.f-static.net/uploads/4366632/normal_5f950a07e8cd8.pdf
- https://s3.amazonaws.com/ronenitevodo/bankers_adda_english_quiz.pdf
- https://uploads.strikinglycdn.com/files/d1fb6b86-e592-4adb-bcee-7af937f60c9a/mejijerona.pdf
- https://s3.amazonaws.com/daniwodug/fujofojuruxetefadifig.pdf
- https://s3.amazonaws.com/salosibejodod/crunchyroll_bad_gateway.pdf
- https://s3.amazonaws.com/jamokaroxoj/37744681486.pdf
- https://uploads.strikinglycdn.com/files/702776f1-4f3c-4967-bd7b-8af10d1d7133/tweakbox_apk_downloader.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.