PDF malware analysis — malicious · 716a8072c68b73ca

MALICIOUS

PDF

47.2 KB Created: 2020-12-08 19:32:50 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 196d742dd114cf0aa5c038a4f6ed1a35 SHA-1: b4e08a837da4e214ff341969101eccfd1051ef50 SHA-256: 716a8072c68b73ca9750b809a9cb359fc7636fa7ebd95fb6d080e48920e84bb0

94 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF file was detected as malicious by ClamAV and an ML classifier. It contains an embedded URI pointing to a suspicious domain, traffnew.ru, which is likely part of a phishing or malware distribution scheme. The document body, though heavily obfuscated, suggests an attempt to disguise the malicious intent with educational-sounding text.

Machine Learning

Nyx PDF Classifier malicious score 0.7023

Heuristics 3

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://traffnew.ru/strik?utm_term=lateral+surface+area+of+a+hexagonal+prism
- https://cdn-cms.f-static.net/uploads/4425501/normal_5fc36db9d79b6.pdf
- https://cdn-cms.f-static.net/uploads/4370057/normal_5f97d77ddaf61.pdf
- https://static1.squarespace.com/static/5fc670f98ef7301f8b370534/t/5fca34cf822fbd3263e888f9/1607087315092/27325926032.pdf
- https://uploads.strikinglycdn.com/files/03b6dc5d-c5ea-4730-8e92-71f1848664e2/sight_reading_exercises.pdf
- https://uploads.strikinglycdn.com/files/990bde95-b2fd-4ed1-98b7-fb3b709b6647/35299687740.pdf
- https://uploads.strikinglycdn.com/files/f49f47c0-88eb-457d-9289-ae60fa9c03f1/16551773057.pdf
- https://s3.amazonaws.com/bisazabe/module_3_study_guide_answers.pdf
- https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbd0b373fdc31513a1196f7/1606224697397/hahn_appliance_outlet_inventory.pdf
- https://static1.squarespace.com/static/5fc15df1e9fc3622d5255c20/t/5fc5030b1972c46e3c3b1572/1606746895165/72992813335.pdf
- https://s3.amazonaws.com/debiwelof/tanamepiz.pdf
- https://static1.squarespace.com/static/5fbffc42bda9c57a97b92422/t/5fc14d333570fb44d132e586/1606503734114/55464145233.pdf
- https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbcf0e279c08c7f2b9da255/1606217955290/michael_buble_wedding_songs_everything_lyrics.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.