PDF malware analysis — malicious · 42b30708e4acf943

MALICIOUS

PDF

42.2 KB Created: 2020-12-21 20:40:59 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: c81a93c2c8e974ad97f3574e1f5b973f SHA-1: 411cd690a8e840738bc649b80273f7ed37810465 SHA-256: 42b30708e4acf943f5888766763f9e2225312f05d24b0dd8dac89d4bed16ff70

64 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The file is identified as malicious by ClamAV with a Pdf.Phishing.Trojan signature. It contains an embedded URI pointing to 'trafffi.ru', which is likely a phishing or malware distribution site. The document body, though heavily obfuscated, appears to reference search terms related to 'Pokemon showdown teams gen 8', suggesting a lure to trick users into visiting the malicious URL.

Machine Learning

Nyx PDF Classifier suspicious score 0.4904

Heuristics 3

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://trafffi.ru/123?utm_term=pokemon+showdown+teams+gen+8
- https://static1.squarespace.com/static/5fc57099a3bf4b14abc7ab13/t/5fcef131509e863c68241af9/1607397681568/hku_admissions_portal.pdf
- https://s3.amazonaws.com/napisakaluja/understanding_definition_of_limits.pdf
- https://s3.amazonaws.com/wiwuxot/29537475989.pdf
- https://uploads.strikinglycdn.com/files/0e36f1bc-ca01-4f11-9886-3066d0d260cb/futimaroleraz.pdf
- https://s3.amazonaws.com/banula/zoey_101_nicole_left.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.