PDF malware analysis — malicious · cc76e5e7abcec485

MALICIOUS

PDF

52.3 KB Created: 2020-11-18 11:45:14 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 3dd5ffbd19d5c9b8b7b714f61fc51fa6 SHA-1: f10e4eed45aa948c9d49ab29db185f429bd10669 SHA-256: cc76e5e7abcec48508c45ae16a14720b427f3e1502e6203455048fffafd95101

94 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The file is identified as malicious by ML classifiers and ClamAV, with ClamAV specifically flagging it as a phishing trojan. The PDF contains an embedded URI pointing to 'trafftec.ru', which is likely part of the phishing lure. Although no scripts were explicitly extracted, the presence of embedded URIs and the overall detection suggest an attempt to redirect users to a malicious site, likely for credential harvesting or malware delivery.

Machine Learning

Nyx PDF Classifier malicious score 0.7015

Heuristics 3

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://trafftec.ru/aws?utm_term=aircraft+performance+group+manual
- https://cdn-cms.f-static.net/uploads/4372987/normal_5f95eed720be6.pdf
- https://numuluga.weebly.com/uploads/1/3/4/3/134307024/1814029.pdf
- https://tatunonomufobuf.weebly.com/uploads/1/3/4/3/134355176/256982.pdf
- https://cdn-cms.f-static.net/uploads/4368949/normal_5f996e8f6243d.pdf
- https://xifobosakup.weebly.com/uploads/1/3/2/8/132815359/585607.pdf
- https://gadipofonikiw.weebly.com/uploads/1/3/4/3/134390141/bosozasumobakubib.pdf
- https://uploads.strikinglycdn.com/files/b200944e-8504-476e-82d9-c84f7e9c334a/xopapexekanofoxevupiv.pdf
- https://uploads.strikinglycdn.com/files/4c30c30b-3ccc-4116-b520-9a5596712bb2/500_calorie_diet_plan_meals.pdf
- https://uploads.strikinglycdn.com/files/fe7b3628-6ffd-4ba6-8db5-0a2e37b4073f/sunimugijakekijus.pdf
- https://uploads.strikinglycdn.com/files/1ae85309-44fd-4d52-90f3-bae5d044d9c6/website_templates_psd_video.pdf
- https://uploads.strikinglycdn.com/files/d1c1c027-d578-46c4-83c8-91b692942a7a/nordictrack_audiorider_r400_recumbent_exercise_bike.pdf
- https://s3.amazonaws.com/bifadiwuwileji/xiduvakun.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.