PDF malware analysis — malicious · 4b5088acbde26056

MALICIOUS

PDF

45.6 KB Created: 2021-10-11 15:42:30 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-11-24

MD5: b088bcb4804268e6c06f99c0f64924a9 SHA-1: ddb84e0327fd9eb1e310461b96e35767039d5e3e SHA-256: 4b5088acbde26056ce1d149b28b2012c8c68ef34189583a6e11f0a966c495e63

94 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The file was detected as malicious by ML classifiers and ClamAV, specifically identified as a phishing trojan. It contains embedded URLs that lead to external sites, suggesting an attempt to redirect users to potentially harmful content. The PDF structure and embedded URIs indicate a likely phishing or malware distribution vector.

Machine Learning

Nyx PDF Classifier malicious score 0.8550

Heuristics 3

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://szpitalstrzelin.pl/userfiles/files/76515038242.pdf In PDF document text
- http://phongthuydotho.vn/upload/files/nejinoxijebu.pdfIn PDF document text
- http://www.ktgroup.co.uk/ckfinder/userfiles/files/93775703214.pdfIn PDF document text
- https://nhatngudongkinh.phapluatvietnam.com/upload/ckupload/files/98971446965.pdfIn PDF document text
- http://spc1991.com/ckfindIn PDF document text
- http://feedproxy.google.com/~r/MbOu/~3/BGAemAmcdTc/uplcv?utm_term=how+to+clean+clear+plasticPDF link annotation

Open this report in the interactive analyzer, or submit your own file for analysis.