Malicious PDF — malware analysis report

Static analysis result for SHA-256 bb996f9b459c0c53…

MALICIOUS

PDF

52.6 KB Created: 2020-12-28 08:58:39 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 6d2a52b42c0d641e2908621246f886c6 SHA-1: ab507613865c775f1b949e0fb5af8236bb92823e SHA-256: bb996f9b459c0c53b06f6d3ecc5c5dcedca780ce66494d36104e348ceaeed83e
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The file is identified as malicious by multiple heuristics, including ClamAV and an ML classifier. An embedded URI points to 'https://traffset.ru/aws?utm_term=chalo+ishq+ladaaye+movie+song++320kbps', suggesting a phishing or malware distribution attempt. The document body contains obfuscated text, and the PDF structure itself is flagged as suspicious.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8370

Heuristics 3

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffset.ru/aws?utm_term=chalo+ishq+ladaaye+movie+song++320kbps
    • https://cdn-cms.f-static.net/uploads/4454432/normal_5fc092948444b.pdf
    • https://gemamiji.weebly.com/uploads/1/3/4/3/134372226/4de33e.pdf
    • https://cdn-cms.f-static.net/uploads/4385648/normal_5f9b7949d746a.pdf
    • https://sowosevutab.weebly.com/uploads/1/3/4/3/134311467/4670ccaf2eeedd.pdf
    • https://goxezojukaruvuk.weebly.com/uploads/1/3/4/0/134000107/jadivudojirimal_laxumi.pdf
    • https://cdn.sqhk.co/birenejar/Iicbi76/jeraxukorizivezukoja.pdf
    • https://cdn.sqhk.co/miviluwulux/GjhCMCA/sad_punjabi_songs_ringtones_free_download.pdf
    • https://cdn.sqhk.co/kokuxisa/Bjfhegi/33799884367.pdf
    • https://uploads.strikinglycdn.com/files/caafa216-70ff-41c5-943e-1edfc29ad24c/dorizawekemori.pdf
    • https://s3.amazonaws.com/fofeguj/63756311672.pdf
    • https://uploads.strikinglycdn.com/files/58c30bea-1393-44e4-8218-13a344cf3df8/download_pandora_app_for_windows_10.pdf
    • https://s3.amazonaws.com/wajibile/91335612226.pdf
    • https://uploads.strikinglycdn.com/files/875044e6-65c0-4446-87f1-d8747275c06b/tatumaliputujadejutumela.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.