PDF malware analysis — malicious · a37191d476bf5bb6

MALICIOUS

PDF

58.6 KB Created: 2020-11-11 18:03:20 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 256c463c800be42bf86aafb52be7a8ed SHA-1: a5f3f55cdd3a7c9eb063cc5956fc1f26627f7922 SHA-256: a37191d476bf5bb643edf417f8e30e76914a3fe90543092f55c9681cd8cc2b9d

94 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The file is identified as malicious by multiple heuristics, including a critical ClamAV detection and an ML classifier. The embedded URL points to a domain associated with malicious activity, and the document body, though heavily obfuscated, suggests a lure related to 'Java choose the correct answer questions'. The presence of PDF_URI and EMBEDDED_URL heuristics indicates the document attempts to redirect the user to external content.

Machine Learning

Nyx PDF Classifier malicious score 0.8355

Heuristics 3

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://trafftec.ru/aws?utm_term=java+choose+the+correct+answer+questions
- https://tetabiga.weebly.com/uploads/1/3/4/0/134097499/zefut.pdf
- https://nitiruminaxodax.weebly.com/uploads/1/3/0/7/130738633/fomiduropuli.pdf
- https://pukaxonimuno.weebly.com/uploads/1/3/4/4/134435323/dumekipopikek-roloxom.pdf
- https://fulugive.weebly.com/uploads/1/3/0/8/130874350/gimewo_fagami_bixuvime.pdf
- https://sodumixiseto.weebly.com/uploads/1/3/4/3/134311801/kuvugobev-kiwutipadiki-darepoge.pdf
- https://moxitasa.weebly.com/uploads/1/3/1/4/131454719/1068965.pdf
- https://s3.amazonaws.com/vezumobigodub/lumber_tycoon_2_op_script_pastebin.pdf
- https://s3.amazonaws.com/kotenu/17039359974.pdf
- https://uploads.strikinglycdn.com/files/7a1fc878-b1b4-43e0-9682-c07a7099b279/dewekurilufunezulivodax.pdf
- https://uploads.strikinglycdn.com/files/72209aee-fefe-4454-a3d4-4893c0f077be/star_trek_adventures_download.pdf
- https://s3.amazonaws.com/sikuva/serujasetewi.pdf
- https://uploads.strikinglycdn.com/files/2bb860b3-a3b8-4771-81fe-d4fa4671ec0d/xawivarekameko.pdf
- https://s3.amazonaws.com/jeworurowam/80997308000.pdf
- https://s3.amazonaws.com/nagev/hay_evaluation_criteria.pdf
- https://s3.amazonaws.com/mujevubutukoxu/free_roblox_cards_for_robux.pdf
- https://s3.amazonaws.com/tezofuretejom/dnd_5e_grung_pc.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.