PDF malware analysis — malicious · 61884b7cdb63a059

MALICIOUS

PDF

58.2 KB Created: 2021-05-23 01:58:17 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 96bbd54807ac1adff1dd3d4a3c2ee3e8 SHA-1: 80b892086fe45a26ae7fd7bbb81951f6f89e94cb SHA-256: 61884b7cdb63a0599cbda3f1ae37522351863c2da4a011e4522207ee165cc3b6

114 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF file is identified as a phishing lure due to its structure, containing an image that likely conceals a clickable link. The embedded URL, https://dugedepap.ru/strik?utm_term=resumen+del+libro+el+llano+en+llamas+por+capitulos, directs users to a suspected phishing page. ClamAV also detected this file as Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0, further indicating malicious intent.

Machine Learning

Nyx PDF Classifier malicious score 0.9085

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE

PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 58 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://dugedepap.ru/strik?utm_term=resumen+del+libro+el+llano+en+llamas+por+capitulos
- https://belesekazisose.weebly.com/uploads/1/3/5/3/135397511/pexuronejepisus.pdf
- https://static.s123-cdn-static.com/uploads/4465719/normal_5fdd038f51ad7.pdf
- https://static.s123-cdn-static.com/uploads/4478923/normal_5ffb593ecf790.pdf
- https://pixelisikug.weebly.com/uploads/1/3/1/4/131407736/da30816a6c.pdf
- https://static.s123-cdn-static.com/uploads/4478687/normal_5fdd029235b21.pdf
- https://tawojupaker.weebly.com/uploads/1/3/4/8/134885799/9948ea455a487.pdf
- https://risegutu.weebly.com/uploads/1/3/4/2/134265716/bajinivo.pdf
- https://static.s123-cdn-static.com/uploads/4408720/normal_5fe321d67ec24.pdf
- https://cdn-cms.f-static.net/uploads/4365591/normal_60509ac75c553.pdf
- https://cdn-cms.f-static.net/uploads/4449009/normal_601f28f790d15.pdf
- https://static.s123-cdn-static.com/uploads/4380237/normal_5fec875c395f8.pdf
- https://zuzotupewumu.weebly.com/uploads/1/3/4/6/134691050/mivupemolep_gupexajos.pdf
- https://cdn-cms.f-static.net/uploads/4448137/normal_603b4359d96d5.pdf
- https://cdn-cms.f-static.net/uploads/4445115/normal_601bf59031c27.pdf
- https://cdn-cms.f-static.net/uploads/4467975/normal_6019676430262.pdf
- https://cdn-cms.f-static.net/uploads/4466153/normal_605fed6609266.pdf
- https://uploads.strikinglycdn.com/files/84eef72e-7aa6-442a-8e22-4196147b6543/canon_430ex_ii_service_manual.pdf
- https://s3.amazonaws.com/jidosatikim/viper_ds4_installation_cost.pdf
- https://uploads.strikinglycdn.com/files/ad45e7d6-f261-4452-a25a-6c14b6fe8146/96371683840.pdf
- https://uploads.strikinglycdn.com/files/fc0b3248-1a02-4f5a-ad32-bce171c31ad6/kekisuwape.pdf
- https://s3.amazonaws.com/zazelujeju/woguvifirila.pdf
- https://uploads.strikinglycdn.com/files/c319958f-2c6b-4a56-9f46-3bfa083bee87/what_is_the_difference_between_food_chain_and_food_web_class_10.pdf
- https://s3.amazonaws.com/jevedijadiki/how_to_calculate_total_flow_respiratory.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.