PDF malware analysis — malicious · cfb442cc955d6c3f

MALICIOUS

PDF

66.6 KB Created: 2021-02-15 11:09:45 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: d4640600ca93e73c79c75f76be8a7dd1 SHA-1: a7c27324a904f2de2be16bc3967180d047b20ae1 SHA-256: cfb442cc955d6c3fd2e7fb04e3676b7d778a44e4db9f3bd16a14da8504759f45

94 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The file is identified as malicious by ML classifiers and ClamAV, with a high risk score. It contains an embedded URI pointing to 'seumenha.ru', which is likely a phishing or malware distribution domain. The document body, though heavily obfuscated, suggests a catalogue theme, which is a common lure for social engineering attacks. No scripts were extracted, but the presence of embedded URLs and the overall malicious verdict strongly indicate a phishing or downloader attack pattern.

Machine Learning

Nyx PDF Classifier malicious score 0.8868

Heuristics 3

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://seumenha.ru/aws?utm_term=catalogue+g%25C3%25A9n%25C3%25A9ral+schneider+electric+international+2012+pdf
- https://cdn.sqhk.co/remimidotomi/bCgfYQq/the_pentagon_wars_book_review.pdf
- http://trikotoria.ru/aC59FkC4B1mC4B1n_beden_dilirjyt9.pdf
- http://tortomsk.ru/audio_audition_3._0_free00oit.pdf
- http://evakuator-uga.ru/spotify_premium_crack_gratisks1dd.pdf
- https://s3.amazonaws.com/panalipolifod/89611839483.pdf
- https://s3.amazonaws.com/kotenu/demisabixuj.pdf
- https://s3.amazonaws.com/gogonof/chakravyuh_movie_1080p.pdf
- https://s3.amazonaws.com/bopuxosavubare/picsart_free_for_pc_windows_10.pdf
- https://s3.amazonaws.com/pujinit/zifovunu.pdf
- https://s3.amazonaws.com/nafibanefexex/quotation_letter_sample_template.pdf
- https://s3.amazonaws.com/buwosevax/cbse_net_july_2018_admit_card.pdf
- https://s3.amazonaws.com/firigugixujotov/wipowarebejasuluvaru.pdf
- https://s3.amazonaws.com/xamibebulosaxug/cpm_ebooks_integrated_3_answers.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.