PDF malware analysis — malicious · b2b7b8fc3c48fd14

MALICIOUS

PDF

49.6 KB Created: 2021-01-12 12:02:06 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 1aee84783ddf66510c1438b66ae888a2 SHA-1: 11159fdb8d54beab15e0b181b95d1a2cbc015e31 SHA-256: b2b7b8fc3c48fd14af81bc9d5b2afae4067ecf796ca5fddca68c5684e7ad4c2e

94 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains an embedded URI pointing to 'traffking.ru', which is likely used to host a malicious payload or redirect to a phishing site. The presence of multiple Weebly-hosted PDF URLs further suggests a campaign distributing malicious documents.

Machine Learning

Nyx PDF Classifier malicious score 0.5575

Heuristics 3

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://traffking.ru/aws?utm_term=avengers+theme+trombone+pdf
- https://vodexekuteb.weebly.com/uploads/1/3/0/7/130776001/meziletawepal_sonob_waroxar_modudedegiwa.pdf
- https://jixejuterekafiw.weebly.com/uploads/1/3/4/5/134508928/mudobun.pdf
- https://jirorenuges.weebly.com/uploads/1/3/0/8/130874518/9d3dc.pdf
- https://cdn-cms.f-static.net/uploads/4368978/normal_5fe980911c7bd.pdf
- https://s3.amazonaws.com/dozore/spanish_english_cognates_2_answer_key.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.