PDF malware analysis — malicious · bcba00b2f5a65587

MALICIOUS

PDF

50.6 KB Created: 2021-01-08 07:30:28 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2026-06-05

MD5: cac1ed4f163e0fe02cfb2de70dff6aef SHA-1: 06333d36e4a8e054c568c3d44562959cb9c0c1b4 SHA-256: bcba00b2f5a65587fc567b49652a8fe8265987e338e3ad919cfffbb330b158bd

94 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The file is a PDF document that contains a link to a suspicious URL, suggesting a phishing or malware distribution attempt. The ClamAV detection and ML classifier flagging further indicate malicious intent. Although no scripts were extracted, the presence of an external URI and the document's metadata suggest it is designed to trick users into visiting a malicious site.

Machine Learning

Nyx PDF Classifier malicious score 0.5465

Heuristics 3

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://trafffi.ru/aws?utm_term=solvency+2+reporting+explained PDF link annotation
- https://cdn-cms.f-static.net/uploads/4383800/normal_5f9bfd6e5de71.pdfIn PDF document text
- https://cdn.sqhk.co/sezunofubuzi/eAhcODa/adventureland_water_park_altoona_iowa.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4404723/normal_5f9a791a796be.pdfIn PDF document text
- https://cdn.sqhk.co/dajebala/JsifZ3N/6369117187.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4413119/normal_5fe14095922d2.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/75676520-85aa-4b5b-86f4-dce2852a3943/daxuxupaxumux.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.