PDF malware analysis — malicious · 740b9dd122785d83

MALICIOUS

PDF

67.6 KB Created: 2021-04-27 01:01:54 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: fa3d0b2faeba7516ccc6c4c7d3d1bb63 SHA-1: e485d946b81fac66a2af504126642c33d0144b9f SHA-256: 740b9dd122785d83c56b38c37c9a6dc9b3b802ed6381af4788ee47967e463bf9

94 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The file is a PDF document identified as malicious by ML classifiers and ClamAV. It contains an embedded URI pointing to a suspicious URL, which is likely part of a phishing or malware distribution scheme. The document body, though heavily obfuscated, suggests a lure related to a 'Vizio remote e701i-a3', aiming to trick users into visiting the malicious link.

Machine Learning

Nyx PDF Classifier malicious score 0.9576

Heuristics 3

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://jottigo.ru/strik?utm_term=vizio+remote+e701i-a3
- https://cdn.sqhk.co/lupokuna/4Rghlje/48153580772.pdf
- https://bugebapujeze.weebly.com/uploads/1/3/1/6/131606260/09f1bee624.pdf
- https://cdn-cms.f-static.net/uploads/4461516/normal_603a52e9c351f.pdf
- https://cdn.sqhk.co/jagibuvat/ggcdAid/kilolebaf.pdf
- https://faripolugariwel.weebly.com/uploads/1/3/1/4/131453512/verupisululijatevas.pdf
- http://potajin.iblogger.org/14107248779.pdf
- https://cdn.sqhk.co/fosikikevo/ihIichb/the_crown_duck_shoot_extended.pdf
- https://cdn-cms.f-static.net/uploads/4379233/normal_60527debba652.pdf
- https://dubelaxelafef.weebly.com/uploads/1/3/1/1/131164372/zujuwirajul.pdf
- https://xibomuwupipufa.weebly.com/uploads/1/3/5/3/135389044/1151454.pdf
- https://static.s123-cdn-static.com/uploads/4487622/normal_6005342f3923a.pdf
- https://cdn-cms.f-static.net/uploads/4379355/normal_605a76028ac3f.pdf
- https://radebijudowax.weebly.com/uploads/1/3/1/6/131607027/85c484764c48b12.pdf
- https://cdn-cms.f-static.net/uploads/4480749/normal_6010d959b5b48.pdf
- https://s3.amazonaws.com/votawawo/can_you_get_fusion_360_for_free.pdf
- https://s3.amazonaws.com/dinigugaxej/xewaxebovezaf.pdf
- https://s3.amazonaws.com/wuwabobujasivor/31810832234.pdf
- https://s3.amazonaws.com/lolijexejomak/20116321660.pdf
- http://zanatibagewo.rf.gd/aramaic_bible_in_english.pdf
- http://xilawon.epizy.com/91796517958.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.