PDF malware analysis — malicious · 7a5cec953fe9a5ac

MALICIOUS

PDF

84.6 KB Created: 2020-12-11 06:42:35 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-11

MD5: 220b3c14ccd37c6a84639b95abcc12f3 SHA-1: c9e831ff6d8c5164e958a4dc98ca4f5dc446dd53 SHA-256: 7a5cec953fe9a5ac1cbdf34e24dca1e8ef21f77c13476b703b653d7d6b81d670

94 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF file was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains an embedded URI pointing to 'https://trafficel.ru/aws?utm_term=chinese+anime+series', which is likely part of a phishing or malware distribution scheme. The document body, though heavily obfuscated, contains text related to 'Chinese anime series' and authoring information, suggesting a lure to entice users to click the malicious link.

Machine Learning

Nyx PDF Classifier malicious score 0.9481

Heuristics 3

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://trafficel.ru/aws?utm_term=chinese+anime+series PDF link annotation
- https://cdn-cms.f-static.net/uploads/4386605/normal_5f8caf43e47f2.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4459341/normal_5fa938ea2f322.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4367921/normal_5f87d0155f3ab.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/46320601-8de2-43ad-954b-d0a670979edc/zenajo.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/5d214544-1672-4438-b2d4-18cc87d4a529/39833802344.pdfIn PDF document text
- https://s3.amazonaws.com/kifutizijebuj/publisher_bookmark_template_free.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c1cb10df-7448-4942-bc3c-fb0466b23a58/28205490955.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/cbfc634a-0114-435b-b165-8554580f8a25/statistical_studies_statistical_investigations_margin_of_error.pdfIn PDF document text
- https://s3.amazonaws.com/kovilowab/11527911233.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f3caa99f-11c9-4d9f-b508-a80147b2c58d/68036740293.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c09190c6-dfd9-4956-b790-ba220af578d5/too_young_to_be_a_dad_full_movie_online.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/925cef89-dfda-403c-a887-95bca9bc5b01/denamarin_advanced_for_large_dogs.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/3e822a83-74a3-4ce5-a3a0-adc552e99714/curso_de_electronica_cekit_completo.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.