PDF malware analysis — malicious · 3c88988f5b882c5b

MALICIOUS

PDF

49.5 KB Created: 2020-12-14 18:36:57 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 8af9df44710eaa359f121c7aeacc57cc SHA-1: 6e3a91f895d417567b5d27578b9d047863bfca4b SHA-256: 3c88988f5b882c5b3dc953803c8d6d8b411b6128016a6aed535b493572255825

94 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF contains an embedded URL that redirects to a suspicious domain, likely for phishing or malware distribution. The document body, though heavily obfuscated, contains text related to "elk river high school football" and the authoring application, suggesting a lure. The presence of a PDF URI heuristic and ClamAV detection further supports its malicious nature.

Machine Learning

Nyx PDF Classifier malicious score 0.8166

Heuristics 3

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://traffnew.ru/strik?utm_term=elk+river+high+school+football
- https://cdn-cms.f-static.net/uploads/4385004/normal_5fba180ca81c5.pdf
- https://s3.amazonaws.com/lolaritemukole/xusopodusagudasojot.pdf
- https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbe0434bc819f1cf49f46c9/1606288437627/la_ciudad_del_olvido_buenos_dias.pdf
- https://static1.squarespace.com/static/5fce85012ff52d7d296203e8/t/5fd6262e491a58544a09559a/1607869998482/water_cycle_worksheet_for_2nd_grade.pdf
- https://static1.squarespace.com/static/5fc0d7dc3dfdd95b60d4c91c/t/5fc173ed9ee0f32b8789efc2/1606513645942/zabiwajil.pdf
- https://s3.amazonaws.com/wovitiku/fonigobuzatetofulilogela.pdf
- https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbf4c7ee18c5c478ef229bb/1606372479202/80907131463.pdf
- https://s3.amazonaws.com/tifuwuw/dominic_west_net_worth_2019.pdf
- https://s3.amazonaws.com/zevutebulaworel/mxq_pro_4k_tv_box_manual.pdf
- https://s3.amazonaws.com/fonazuzixagizir/maytag_epic_z_washer_service_manual.pdf
- https://s3.amazonaws.com/lixuzo/sobo_and_sobo_phone_number.pdf
- https://s3.amazonaws.com/vudivuzakal/49815279497.pdf
- https://s3.amazonaws.com/besafefaf/vomajutebafukevubawobe.pdf

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000b346.bin` `e9df1abf47a688c52bbf36275161d4c71dd3d5463c3e540779115c3c600865d9`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xB346	3304 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.