PDF malware analysis — malicious · b8d40ecb007a3e2a

MALICIOUS

PDF

41.6 KB Created: 2020-12-24 19:45:05 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: eb8e4742c781ab13646fb81978a35c32 SHA-1: b725d1df087cfba376c15f43bd3d6862f62a13b8 SHA-256: b8d40ecb007a3e2a0d74a60cdca8c90de341d84f21c4017b5a11df928bd245b6

94 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The presence of an external URI pointing to 'trafffe.ru' suggests the document is designed to redirect users to a potentially harmful site. Although no scripts were explicitly extracted, the PDF structure and heuristic firings strongly suggest a phishing or malware delivery attempt.

Machine Learning

Nyx PDF Classifier malicious score 0.7791

Heuristics 3

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://trafffe.ru/aws?utm_term=borg+cr10+scale+pdf
- https://cdn-cms.f-static.net/uploads/4366358/normal_5f918d4469239.pdf
- https://cdn.sqhk.co/jesisuvov/bLIAsjg/hd_tumblr_wallpaper_for_laptop_full_screen.pdf
- https://cdn.sqhk.co/gatutojuse/ihhjhjg/music_id_app_free_without_wifi.pdf
- https://static.s123-cdn-static.com/uploads/4413467/normal_5fe310d1bb289.pdf
- https://cdn.sqhk.co/donewipimep/hh3jgiC/descargar_los_sims_mobile_hack_apk_ios.pdf
- https://cdn.sqhk.co/dobopejig/UigBp4s/green_mucus_poop_pregnant.pdf
- https://pigogokeda.weebly.com/uploads/1/3/1/8/131857695/devewatavonixo_marige.pdf
- https://uploads.strikinglycdn.com/files/20156dd5-e602-485e-888b-cad3ef3b8606/lofovetek.pdf
- https://uploads.strikinglycdn.com/files/8c15bc04-34bf-4d08-ac69-c97dfa2ae0cb/functional_medicine_matrix_example.pdf
- https://s3.amazonaws.com/rakabexozu/69247416688.pdf
- https://s3.amazonaws.com/memul/bnf_online.pdf
- https://s3.amazonaws.com/xulepiwa/20463799188.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.