PDF malware analysis — malicious · c13958003bcd512b

MALICIOUS

PDF

56.8 KB Created: 2021-10-10 06:27:07 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-11-24

MD5: 2cd67243ce0d6aaeaf40c9247685556e SHA-1: 61be28446253db18de4fa76f506f13678331a649 SHA-256: c13958003bcd512b5cf14489006051030608d640fa87e7cd34b30e24d3c15438

94 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF document contains embedded URLs that lead to potentially malicious sites, as indicated by heuristic firings and ClamAV detection. While no scripts were explicitly extracted, the presence of embedded URIs and the ML classifier's output suggest a phishing or trojan delivery attempt. The document body was unreadable, preventing a more specific analysis of the lure.

Machine Learning

Nyx PDF Classifier malicious score 0.5442

Heuristics 3

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://askort.pl/Upload/file/bolaxufexilagepa.pdf In PDF document text
- https://www.grecosalesinternational.com/wp-content/plugins/formcraft/file-upload/server/content/files/1613e3487082c8---zometelosidugegunu.pdfIn PDF document text
- https://feedproxy.google.com/~r/skout/mBVl/~3/3CAf4wW3hvY/uplcv?utm_term=filthy+frank+rice+fieldsPDF link annotation

Open this report in the interactive analyzer, or submit your own file for analysis.