PDF malware analysis — malicious · e66833c95ef480ea

MALICIOUS

PDF

48.0 KB Created: 2020-11-19 16:42:04 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 5b508c2a48fff53948bbc78ed0571448 SHA-1: 003c36c64afdfae5267b485b960c22f367aa6a22 SHA-256: e66833c95ef480ea05b3346f476f38564bcf1cbe641f958b1e3e058c4ec39da5

94 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF file was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains an embedded URI pointing to a suspicious domain, which is likely used to host a phishing page or deliver a second-stage payload. The document body, though heavily obfuscated, contains references to 'wkhtmltopdf' and a date, suggesting it might be a crafted lure.

Machine Learning

Nyx PDF Classifier malicious score 0.7249

Heuristics 3

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://trafficel.ru/strik?utm_term=the+perfect+pistol+shot
- https://cdn-cms.f-static.net/uploads/4406223/normal_5f95801ee8f19.pdf
- https://cdn-cms.f-static.net/uploads/4368224/normal_5f9a99c8c1b8d.pdf
- https://uploads.strikinglycdn.com/files/4d8adb5c-17cf-4a6e-ac58-939bf37dc0c9/45889589520.pdf
- https://s3.amazonaws.com/buxoparadazegu/galliano_elementary_school_home_page.pdf
- https://uploads.strikinglycdn.com/files/4e79ce4b-5d1f-42a4-807e-fc6c30082d0b/24_hour_fitness_northgate_trainers.pdf
- https://s3.amazonaws.com/tubupejevomo/string_adapter_recyclerview_android.pdf
- https://s3.amazonaws.com/tikoweravisixu/24695406221.pdf
- https://uploads.strikinglycdn.com/files/7c7baa86-ae0b-4238-97b8-d07fee059184/1363528802.pdf
- https://s3.amazonaws.com/lemefofutomapox/sozopenudotikumifonaj.pdf
- https://s3.amazonaws.com/nopomewegobij/legexawalebi.pdf
- https://s3.amazonaws.com/henghuili-files/rosibesemosuv.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.