PDF malware analysis — malicious · e3e069d448e81c42

MALICIOUS

PDF

49.7 KB Created: 2021-08-26 00:59:20 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-04

MD5: 88f53d72dffcda62046cda411cb7bf96 SHA-1: 82010da29dd45ebed0b18b1eb8347b5e83ffda93 SHA-256: e3e069d448e81c4202b123f7c6bd520b1a76f8428c02f3678d00d9452702f01d

64 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The ClamAV heuristic identified this PDF as a phishing trojan. The embedded URL and multiple other suspicious URLs extracted from the document body suggest a phishing attempt to lure users to malicious sites. The PDF structure and embedded content are consistent with common phishing lures.

Machine Learning

Nyx PDF Classifier suspicious score 0.4043

Heuristics 3

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://allamericannursing.com/userfiles/file/85497136157.pdf In PDF document text
- http://hotelclinton.it/userfiles/files/19572504450.pdfIn PDF document text
- http://charlotteellisscholarship.com/clients/a/a5/a56794a54ce3a7e2a8fdc514f00cf952/File/pebutevagu.pdfIn PDF document text
- http://heilpraxis-pankow.de/wp-content/plugins/formcraft/file-upload/server/content/files/1609e4c1068e9c---digevefe.pdfIn PDF document text
- https://feedproxy.google.com/~r/skout/mBVl/~3/fzgW7-mxBc0/uplcv?utm_term=just+one+more+thingPDF link annotation

Open this report in the interactive analyzer, or submit your own file for analysis.

PDF

Malware Insights

Machine Learning

Heuristics 3

Related samples 4