PDF malware analysis — malicious · ae2f627e17ace85b

MALICIOUS

PDF

41.4 KB Created: 2020-11-25 22:37:56 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: d51d9d34a0dd90794fc71f78b1936b43 SHA-1: c28022c48d7b17311df849f64c6e1190e13e849a SHA-256: ae2f627e17ace85b3f96fea27c9e598fe834010dffc6464570b3bc5ced0478a7

114 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF is identified as a phishing lure due to its image-heavy nature and embedded clickable link. The heuristic 'PDF_IMAGE_LURE' indicates a common tactic where a screenshot is used to obscure a malicious action. The embedded URL, https://traffset.ru/aws?utm_term=aadhalal+kadhal+seiveer+song++2013, is the primary indicator of compromise, likely leading to a malicious site.

Machine Learning

Nyx PDF Classifier malicious score 0.8493

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE

PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 41 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://traffset.ru/aws?utm_term=aadhalal+kadhal+seiveer+song++2013
- https://cdn-cms.f-static.net/uploads/4369190/normal_5f8b9e12f0ed8.pdf
- https://mozubuwuvufizo.weebly.com/uploads/1/3/4/6/134600540/nabiwubisef.pdf
- https://cdn-cms.f-static.net/uploads/4486971/normal_5fbdc92c91946.pdf
- https://xumogimunosu.weebly.com/uploads/1/3/1/6/131607683/4328a.pdf
- https://cdn-cms.f-static.net/uploads/4459062/normal_5fbce5bfa8b25.pdf
- https://dudikojegak.weebly.com/uploads/1/3/1/4/131406444/e1667a87f71a7.pdf
- https://govonomuvilikiw.weebly.com/uploads/1/3/4/6/134620083/pebikipuxirigexexad.pdf
- https://s3.amazonaws.com/baposivarabuj/alvarado_escala.pdf
- https://uploads.strikinglycdn.com/files/6cd09f2f-9b2c-45b2-9700-297c2f2b8893/bijululofaxufirojagunibu.pdf
- https://uploads.strikinglycdn.com/files/c4044645-7f50-43ad-99f9-6a038dba64bf/wosoda.pdf
- https://s3.amazonaws.com/wizuluworafid/zetekowutipir.pdf
- https://s3.amazonaws.com/liwafo/osrs_goblin_diplomacy_quick_guide.pdf
- https://s3.amazonaws.com/fasomusogapovi/utorrent_mac_softonic.pdf
- https://s3.amazonaws.com/tosevud/building_construction_company_profile_template.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.