PDF malware analysis — malicious · b68a7f6b49db163e

MALICIOUS

PDF

44.6 KB Created: 2021-08-12 07:41:42 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-27

MD5: 7a2b48290d331f6839c6ecc4afe09a6f SHA-1: b7ca8e29302c7ebcb037a18b723a771ed563d00c SHA-256: b68a7f6b49db163e0ae2bd3a0e22e768e77827913ad486c0ba934771cf39ca31

64 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The ClamAV heuristic identified the file as a phishing trojan. The PDF document contains embedded URLs that likely lead to malicious content or further stages of an attack. While one URL was flagged as benign, others remain unknown and suspicious.

Machine Learning

Nyx PDF Classifier suspicious score 0.4589

Heuristics 3

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://salocchi.it/userfiles/files/85798284341.pdf In PDF document text
- https://avonsteel.com/UserFiles/file/sutuzun.pdfIn PDF document text
- https://dsodrecital.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c58ee6bfeb2---jisudixonoduninupagi.pdfIn PDF document text
- https://feedproxy.google.com/~r/Uplcv/~3/fzgW7-mxBc0/uplcv?utm_term=ati+mobility+radeon+hd+5730+driver+windows+7+32+bitPDF link annotation

Open this report in the interactive analyzer, or submit your own file for analysis.