PDF malware analysis — malicious · ead88b2d8ac7d116

MALICIOUS

PDF

67.6 KB Created: 2020-12-25 09:52:21 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-12

MD5: f51f9be68e3be0817173bbc82d186d1f SHA-1: 253de07402fc859f01dae4b683ed64fcfd3df4d4 SHA-256: ead88b2d8ac7d116128385fa25d66a2e616de6ca51a0b125372a1fbcf88ba298

94 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF file was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains an embedded URI pointing to a suspicious domain, likely intended to trick the user into visiting a phishing or malware distribution site. The document body is heavily obfuscated and truncated, preventing a detailed analysis of its specific lure.

Machine Learning

Nyx PDF Classifier malicious score 0.7641

Heuristics 3

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://trafficel.ru/aws?utm_term=mapbox+studio+classic PDF link annotation
- https://cdn.sqhk.co/gemadaruvow/hftgjjf/pajexuximibuwozobuxev.pdfIn PDF document text
- https://kuzeloxowew.weebly.com/uploads/1/3/4/3/134330257/7094266.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/321b711d-88ee-41ff-a285-39c4e700f1e1/ancient_egyptian_prayers.pdfIn PDF document text
- https://s3.amazonaws.com/vibuvomomuv/gajebijufenemudotak.pdfIn PDF document text
- https://s3.amazonaws.com/dobesogum/98915199010.pdfIn PDF document text
- https://s3.amazonaws.com/nawuvud/newaxisedugepade.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/68990968-794f-4ff4-a080-38c56a833543/nuzanelofedirepepibezof.pdfIn PDF document text
- https://s3.amazonaws.com/jazuravazaguz/airsoft_claymore_diy.pdfIn PDF document text
- https://s3.amazonaws.com/fopalew/kefuzalut.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.