PDF malware analysis — malicious · bd03dff57b09470e

MALICIOUS

PDF

35.7 KB Created: 2021-08-25 10:31:49 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-05

MD5: 51ce2a59355f5fadd6c3ede6b95589fa SHA-1: 5915342ed13bee29dec5ff39d00489104b6971c9 SHA-256: bd03dff57b09470e40bb82452d61b8bdc4fd2a60ac2fc5c32e20d6c87aa6c0a4

84 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF is identified as an image-only document with a click-outward action, typical of phishing lures. ClamAV also detected it as Pdf.Phishing.Trojan. The embedded URL, although marked as benign, is part of the lure mechanism. The file's structure and heuristic firings strongly suggest it's intended to redirect the user to a malicious site or initiate a download.

Machine Learning

Nyx PDF Classifier suspicious score 0.3316

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE

PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 35 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL https://feedproxy.google.com/~r/skout/mBVl/~3/PmAiG5ZyT-k/uplcv?utm_term=on+assignment+meaning PDF link annotation

Open this report in the interactive analyzer, or submit your own file for analysis.