PDF malware analysis — malicious · 68010cbd003d2569

MALICIOUS

PDF

40.9 KB Created: 2021-09-02 04:11:36 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-02

MD5: 839450cfc3fe24b0f4a050ffc2b617f2 SHA-1: 8c3e3d44ce8027ac8b9e32ba373a2f99d8997f3f SHA-256: 68010cbd003d25690ef517affaaf6df592bcbb109cf3de2ac77bace22e34eb1b

94 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

Nyx PDF Classifier malicious score 0.8506

Heuristics 3

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://sziazsauto.com/uploads/files/20973300534.pdf In PDF document text
- https://iwnta.com/userfiles/file/jegago.pdfIn PDF document text
- http://wxeina.com/userfiles/files/4781265419.pdfIn PDF document text
- https://we-plus.tw/ckfinder/userfiles/files/lovivesimebivefonokemabo.pdfIn PDF document text
- https://mrmusicfoundation.org/wp-content/plugins/super-forms/uploads/php/files/s0o51ab8phoeask4il11lvvcrb/16581237388.pdfIn PDF document text
- https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/zMnd8XtcwSM/uplcv?utm_term=trailing+stop+cryptoPDF link annotation

Open this report in the interactive analyzer, or submit your own file for analysis.