PDF malware analysis — malicious · e9bacfe95b7abc24

MALICIOUS

PDF

35.9 KB Created: 2021-09-05 16:54:22 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-05

MD5: 83d41dfff2f88a120893177b55aa6782 SHA-1: d6fb82b4ad9be24e01aef89394f2c9af979c6dec SHA-256: e9bacfe95b7abc242a373a6b6dec062e7ac4969f15bdede424a507eb7bc0c66b

114 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF is identified as an image-based lure, typical for phishing attacks, containing a clickable link to an external URL. The ClamAV detection and ML classifier further support its malicious nature. Although no scripts were explicitly extracted, the PDF structure and embedded URI suggest it's designed to redirect the user to a malicious site for further exploitation.

Machine Learning

Nyx PDF Classifier malicious score 0.7601

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE

PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 35 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://synerhu.ru/uplcv?utm_term=fill+in+pdf+form+iphone PDF link annotation
- https://alfa-pechati.ru/wp-content/plugins/super-forms/uploads/php/files/aad7233b433666df4f87052d01642a93/53585119686.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.