PDF malware analysis — malicious · 4d7dba216c93357b

MALICIOUS

PDF

41.6 KB Created: 2020-12-10 23:34:32 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 5491c5704fd3454a9baa3688bbd59e7a SHA-1: 89b1f24e951756f0b849d4271a3bee717661d45c SHA-256: 4d7dba216c93357b8b445411255ebe879e2aafb22dedd15b6378bfa1e76b6f20

114 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

This PDF file is identified as malicious by multiple heuristics and a machine learning classifier. It employs a common phishing tactic by presenting itself as an image-based document with a clickable action, designed to lure users into clicking an external URI. The primary malicious URL identified is trafftec.ru, which is likely used to host or redirect to a malicious payload or phishing page.

Machine Learning

Nyx PDF Classifier malicious score 0.8204

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE

PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 41 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://trafftec.ru/aws?utm_term=small+pdf+merge+split
- https://s3.amazonaws.com/bisute/13465296806.pdf
- https://static1.squarespace.com/static/5fc1412bcd1e280355d6a3a9/t/5fc3299a9b1ed0353844553b/1606625690880/loreal_quick_blue_bleach_directions.pdf
- https://uploads.strikinglycdn.com/files/122937ae-e695-44b2-9950-15bbc4ec3e18/7015417949.pdf
- https://s3.amazonaws.com/pukaridimupo/67101833149.pdf
- https://static1.squarespace.com/static/5fc4fdc5239b0722914b73e7/t/5fd155f1880fa23343c40ca9/1607554546153/puppy_licking_screensaver.pdf
- https://static1.squarespace.com/static/5fc5a039e9fc3622d54217d5/t/5fd18df1c10336458b305c05/1607568882521/kleptocats_2_space_station_purple_ribbon.pdf
- https://s3.amazonaws.com/punagilelabon/12879267086.pdf
- https://s3.amazonaws.com/fezenur/ek_harome_meri_behna_hai_song.pdf
- https://s3.amazonaws.com/sisaxu/real_krusty_krab_restaurant.pdf
- https://static1.squarespace.com/static/5fc06d09e5c7695ca9994347/t/5fd0234c2f29925fbb440d9b/1607476047327/top_100_classic_pinball_machines.pdf
- https://static1.squarespace.com/static/5fc0d4a28139af037644e7e6/t/5fc1aa46f3de5e49b5a31a52/1606527561111/cumulative_frequency_table_example.pdf
- https://static1.squarespace.com/static/5fc14c376609fd0ee7940dbf/t/5fcbb6df0814be4f73efcd9d/1607186143514/48092212113.pdf
- https://s3.amazonaws.com/zolerazowubow/2495652567.pdf
- https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbd01dfedabee7b4408093c/1606222312740/34297653175.pdf
- https://s3.amazonaws.com/sugaguxagu/tuxekuvinek.pdf
- https://s3.amazonaws.com/bodepova/vipefidoleporagive.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.