PDF malware analysis — malicious · 742147711b8b01a1

MALICIOUS

PDF

49.6 KB Created: 2020-12-01 08:37:14 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 6bc65022cc6bbe522be3c3b05e9b0ea5 SHA-1: c5a70146d5d6b166564b3a11dedaad90e19530a2 SHA-256: 742147711b8b01a193e9256eb1e7dae27bc88bd1086bf6768e59c7ff71e73ae9

94 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

This PDF file was detected as malicious by ClamAV and an ML classifier. It contains an embedded URI pointing to 'trafftec.ru', which is likely a phishing or malware distribution site. The document body, though heavily obfuscated, appears to be related to academic content, suggesting a lure to trick users into visiting the malicious URL.

Machine Learning

Nyx PDF Classifier malicious score 0.6779

Heuristics 3

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://trafftec.ru/aws?utm_term=alternate+and+corresponding+angles+worksheet+gcse
- https://cdn-cms.f-static.net/uploads/4365560/normal_5f872121ae7f7.pdf
- https://static.s123-cdn-static.com/uploads/4468274/normal_5fc48c2639b94.pdf
- https://cdn-cms.f-static.net/uploads/4391636/normal_5f8eb4edabac0.pdf
- https://static.s123-cdn-static.com/uploads/4500910/normal_5fc4b23523fc4.pdf
- https://cdn-cms.f-static.net/uploads/4413242/normal_5f96e9b26a8f7.pdf
- https://uploads.strikinglycdn.com/files/91dcfd71-964c-486e-9d4d-0c7f6a51e7a5/76593635633.pdf
- https://uploads.strikinglycdn.com/files/83decf06-82ce-4237-83f6-7fa4ccccb6f8/matlab_3rd_edition.pdf
- https://s3.amazonaws.com/nitizobuv/gexolavinifexevejesa.pdf
- https://static1.squarespace.com/static/5fc32ae812facd59cebbb095/t/5fc542a3cb3e0f5771fbc356/1606763171982/58490666203.pdf
- https://uploads.strikinglycdn.com/files/ebbef246-37c1-43d6-aa91-e49f8e5ae056/paxagewubolixeb.pdf
- https://static1.squarespace.com/static/5fc2e08016f6d44b07cb8ed7/t/5fc5cee0cb3e0f57711943b8/1606799074575/drink_a_beer_lyrics_poster.pdf
- https://static1.squarespace.com/static/5fc4eaba1452f90b7ffed152/t/5fc56393a97599144eade20b/1606771608325/laxufunazusadajaw.pdf
- https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbd07758cb11b25c09d5712/1606223733645/lekerezesufizigefaboj.pdf
- https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbd1fb4e7fdc9583a9b1b30/1606229941108/zapazubuvasaxomaduseviwo.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.