PDF malware analysis — malicious · 691e6f676b1d339a

MALICIOUS

PDF

51.6 KB Created: 2020-11-30 21:24:53 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-11

MD5: 47143297b3b1c6bb0eced3d45ad51808 SHA-1: 757f43c16c758fb7db1273c6018b53645c28bd32 SHA-256: 691e6f676b1d339aef7ae25cd047fe140c575486cf2e2168e9d44c16a1640a33

94 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The file was detected as malicious by ClamAV and an ML classifier. It contains an embedded URI pointing to a suspicious domain, which is likely used to deliver a secondary payload or phish for credentials. Although no scripts were explicitly extracted, the PDF structure and embedded URI suggest an attempt to redirect the user to a malicious site.

Machine Learning

Nyx PDF Classifier malicious score 0.5258

Heuristics 3

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://trafficel.ru/strik?utm_term=mucilage+glue+bottle PDF link annotation
- https://sixapinipuso.weebly.com/uploads/1/3/1/3/131384402/wigisitov_dotebi.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4404285/normal_5f9637a19f42c.pdfIn PDF document text
- https://garagagu.weebly.com/uploads/1/3/4/3/134364865/mozisujinibesow.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/2ec6993a-da80-48e3-b450-043cdcc1f2f9/82639954285.pdfIn PDF document text
- https://s3.amazonaws.com/xoxaneral/aa_meetings_utah.pdfIn PDF document text
- https://s3.amazonaws.com/liwafo/44592458546.pdfIn PDF document text
- https://s3.amazonaws.com/voxazedisula/juan_bautista_de_anza_trail_map.pdfIn PDF document text
- https://s3.amazonaws.com/bejideba/xamag.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/79f977c7-92c4-4c9c-846b-43f85e62d8c4/7084645635.pdfIn PDF document text
- https://s3.amazonaws.com/zerepuzuze/ielts_speaking_questions.pdfIn PDF document text
- https://s3.amazonaws.com/dazinibonofobi/bexebalapilewo.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.