PDF malware analysis — malicious · 57b66dcd031ebb69

MALICIOUS

PDF

49.6 KB Created: 2020-12-19 22:16:52 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 17f1a0a8c3a4f8d783295d0c8a9dfbcd SHA-1: cb3374dd485254bcd84fb6aa26237df7bd10c7bf SHA-256: 57b66dcd031ebb69f99a002ae8afeebf74027060b645a51083d1862ef1affb7a

114 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF file is identified as malicious by ClamAV and an ML classifier. It employs a common phishing tactic by presenting a full-page image as a lure, with an embedded URI that likely leads to a malicious site. The heuristic PDF_IMAGE_LURE specifically indicates this is a screenshot lure designed to trick users into clicking an action trigger.

Machine Learning

Nyx PDF Classifier malicious score 0.6098

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE

PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 49 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://traffnew.ru/aws?utm_term=brevet+fran%25C3%25A7ais+2019+corrig%25C3%25A9+pdf
- https://kusavavatixe.weebly.com/uploads/1/3/4/8/134878613/pafuwarunavelo.pdf
- https://rewudorabemomaf.weebly.com/uploads/1/3/4/2/134234845/mejapeduv-zasok-babalesop-xovozox.pdf
- https://lagukekejase.weebly.com/uploads/1/3/0/8/130815031/bexus-gokawej-wupududixanive.pdf
- https://zesopupejilit.weebly.com/uploads/1/3/0/7/130738861/dalamazerozana_buwalukozoj_nuluxozudowabal.pdf
- https://s3.amazonaws.com/fojaxexino/good_text_messages_to_send_to_your_crush.pdf
- https://s3.amazonaws.com/vuraradaso/las_parabolas_de_jesus_sud.pdf
- https://uploads.strikinglycdn.com/files/35ae75ec-03b5-4648-8fcd-6b9e7b116c5f/40732234782.pdf
- https://uploads.strikinglycdn.com/files/61f15ed3-f6b5-4f18-a711-4650eb03fdd0/crossing_the_line_activity_questions.pdf
- https://s3.amazonaws.com/woxojuxafopuv/l_douglas_wilder_middle_school_henrico_va.pdf
- https://uploads.strikinglycdn.com/files/90c70982-a975-409c-ab10-d563e684b840/80456375899.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.