PDF malware analysis — malicious · 4504fd17fd8047cd

MALICIOUS

PDF

48.0 KB Created: 2020-11-18 00:51:49 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 7ce87f6c9d084b11fb3d54f2e533d836 SHA-1: f7eeecbb345b690ad80e0f5b2212bda911387f84 SHA-256: 4504fd17fd8047cd2ebdc87cadbb0cbf9d2d9019568f381cd41a50f4f3eeb515

114 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

This PDF document is identified as a phishing lure due to its structure, containing only an image and a clickable link. The embedded URL, https://trafffi.ru/strik?utm_term=for+whom+the+southern+belle+tolls, is the primary indicator of malicious intent, likely directing users to a malicious website. The ClamAV detection and ML classifier further support its malicious classification.

Machine Learning

Nyx PDF Classifier malicious score 0.7011

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE

PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 48 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://trafffi.ru/strik?utm_term=for+whom+the+southern+belle+tolls
- https://cdn-cms.f-static.net/uploads/4485818/normal_5fa7aa720f797.pdf
- https://s3.amazonaws.com/tiduro/aarti_sangrah_hindi.pdf
- https://s3.amazonaws.com/zerejibixupav/formal_way_of_asking_questions_in_english.pdf
- https://s3.amazonaws.com/robumuduluwise/christmas_sheet_music_piano_free.pdf
- https://uploads.strikinglycdn.com/files/42bd46c7-b2ea-43ee-8603-6bbf4910b2c5/wifudenesa.pdf
- https://s3.amazonaws.com/goviwigax/manual_usuario_chevrolet_sonic_2016.pdf
- https://s3.amazonaws.com/bejideba/32534585744.pdf
- https://uploads.strikinglycdn.com/files/b1659d00-fb18-48d5-8499-d9e2374e29e8/jupinidamipixubat.pdf
- https://uploads.strikinglycdn.com/files/48427b7e-ddc9-4524-b33b-272519856273/84638582537.pdf
- https://s3.amazonaws.com/wopari/6th_grade_math_staar_practice_test.pdf
- https://uploads.strikinglycdn.com/files/eada52b6-6559-48c8-9222-876e6d08b47d/open_signal_apktops.pdf
- https://s3.amazonaws.com/fedure/40488741054.pdf
- https://s3.amazonaws.com/mexavofezoxi/57397152155.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.