PDF malware analysis — malicious · 805bc995e46e76d8

MALICIOUS

PDF

54.6 KB Created: 2020-12-01 12:12:08 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: c93e46d667045695131f1017f01ffaa4 SHA-1: 6af01bdc0453f8e6c35d0bf44369739f3090dc89 SHA-256: 805bc995e46e76d8e0c5261303b9ccd738c34f41d239e4aa4d77f435869d9030

94 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

This PDF file was detected as malicious by ClamAV and an ML classifier. It contains an embedded URI pointing to a suspicious domain, likely intended to host a phishing or malware payload. The document body, though heavily obfuscated, suggests a lure related to 'earthing sheet for bed' to entice users to click the malicious link.

Machine Learning

Nyx PDF Classifier malicious score 0.7673

Heuristics 3

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://trafffe.ru/aws?utm_term=earthing+sheet+for+bed
- https://cdn-cms.f-static.net/uploads/4369794/normal_5f89dff468298.pdf
- https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbf695f1972c46e3c971e53/1606379871944/city_of_ember_worksheets.pdf
- https://static1.squarespace.com/static/5fc36ab50b6b03258f456e50/t/5fc58430f8cdb769c69fc606/1606779956782/david_taylor_pants.pdf
- https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbf5a1af81c9a2a0c9954b6/1606375963049/coker_college_webadvisor.pdf
- https://static1.squarespace.com/static/5fc18dc424b06a7eb303d081/t/5fc42600145a8629dc3356f8/1606690304898/soduxitebedopaz.pdf
- https://static1.squarespace.com/static/5fc2eceac6d96458362f573e/t/5fc3ee539ee0f32b87ccd853/1606676051757/google_scotty_kilmer_channel.pdf
- https://static1.squarespace.com/static/5fc0d7c89955c744b53b4369/t/5fc1c19b1972c46e3cdfd246/1606533531657/riwuwaboxinemitukegim.pdf
- https://s3.amazonaws.com/pesetufavo/income_tax_calculation_sheet_for_2019-_20.pdf
- https://static1.squarespace.com/static/5fc289bc24b06a7eb309ae07/t/5fc396e35147b14804a16cb8/1606653668507/34024032344.pdf
- https://static1.squarespace.com/static/5fc0187aa5bc066edfa15e28/t/5fc13e03fa04221c714d2021/1606499844496/la_private_investigator_requirements.pdf
- https://static1.squarespace.com/static/5fc4d0d3a3bf4b14abc221fa/t/5fc5cd9708845d09245410b0/1606798744799/vewomok.pdf
- https://static1.squarespace.com/static/5fc0dd745bcb0228a2824d01/t/5fc0f2f418e72e5fdbf98286/1606480628598/65393711456.pdf
- https://static1.squarespace.com/static/5fc0e9eb3398ff75152e2002/t/5fc22f8c4e98326c02599629/1606561678516/49768578862.pdf
- https://static1.squarespace.com/static/5fc36a015687f52b6b9139b6/t/5fc4ffd9e18c5c478e988712/1606746075509/61847389204.pdf
- https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbf4f117acac6192ab73d49/1606373138592/95755188690.pdf
- https://s3.amazonaws.com/muxegeza/39824638924.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.