PDF malware analysis — malicious · de530faa83ec40d7

MALICIOUS

PDF

48.0 KB Created: 2021-01-06 18:05:37 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 562279700f4aada1e3b0b01fd53aab54 SHA-1: 31f397e02161c46f7b998358f88a8e4c94e39acb SHA-256: de530faa83ec40d79cc4ee016098306690fe85dc8e4d373ff135cce098ca5b02

114 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF is identified as an image-based lure, typical of phishing attacks, designed to trick users into clicking a malicious link. The heuristic 'PDF_IMAGE_LURE' indicates the document contains an image overlay with a clickable action. The embedded URL 'https://trafficel.ru/123?utm_term=meq%252Fl+to+mg%252Fl+calcium' is a primary indicator of this malicious intent, likely leading to a phishing page or malware download. The ML classifier and ClamAV detection further support the malicious classification.

Machine Learning

Nyx PDF Classifier malicious score 0.7327

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE

PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 48 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://trafficel.ru/123?utm_term=meq%252Fl+to+mg%252Fl+calcium
- https://cdn.sqhk.co/potekovibe/YWnNdo7/4895945548.pdf
- https://cdn.sqhk.co/xubulozirod/XohCj2Q/non_disclosure_agreement_2020.pdf
- https://uploads.strikinglycdn.com/files/637d0cb9-9e58-444f-93e0-55962971f94e/92358604033.pdf
- https://uploads.strikinglycdn.com/files/defe5273-1b46-48b9-9157-7803e1ef99bc/kukiposomigamubegimumuzen.pdf
- https://uploads.strikinglycdn.com/files/92af2779-515f-4c28-9472-e81e7073bad2/ld_debate_topic.pdf
- https://uploads.strikinglycdn.com/files/87bf487d-61e5-4420-be1b-75d4e79506c8/fosotebosag.pdf
- https://s3.amazonaws.com/joterige/gbs_cidp_guidelines.pdf
- https://uploads.strikinglycdn.com/files/3dacab36-714b-4201-afe0-c95d8e0aa3eb/biografia_de_los_hermanos_flores_magon.pdf
- https://uploads.strikinglycdn.com/files/314aca9b-14ae-4cc8-a7c7-f7e3a9460682/95312178154.pdf
- https://uploads.strikinglycdn.com/files/3c3f52c7-9528-4105-893e-5de3e0cba5c2/gecko_heat_press.pdf
- https://uploads.strikinglycdn.com/files/e376a1d2-8c0b-4769-a6f1-3ed046538847/taporaxanukexiwadatofav.pdf
- https://uploads.strikinglycdn.com/files/4342041e-97e4-4927-bc3a-fb705c097bfe/ms_fernandez_class.pdf
- https://uploads.strikinglycdn.com/files/8a3f1703-11ba-45d0-9751-3d84c3c64cef/how_many_glasses_are_in_a_regular_bottle_of_wine.pdf
- https://uploads.strikinglycdn.com/files/15faec3a-4df8-42c0-a11e-8e21c31756df/zadowijivavo.pdf
- https://s3.amazonaws.com/golepe/formal_definition_of_navigate.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.