PDF malware analysis — malicious · eec9565cf7512e87

MALICIOUS

PDF

52.6 KB Created: 2020-11-13 23:44:23 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-27

MD5: 80f2b3cf5e30a3f1ec4a08f166ace62d SHA-1: 3ba74bf9de7caa30eaf7b09b39c390981af13cb2 SHA-256: eec9565cf7512e871354314630999bfe8f8994ae30de2cc17298761f3fdf87d5

94 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF file contains an embedded URI pointing to a suspicious domain, identified by heuristics and ClamAV as malicious. The document body, though heavily obfuscated, suggests a lure related to software downloads, specifically mentioning 'Coreldraw 2017 64 bit'. This indicates a phishing attempt to trick users into downloading malware.

Machine Learning

Nyx PDF Classifier malicious score 0.7240

Heuristics 3

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://traffnew.ru/aws?utm_term=coreldraw+2017+64+bit PDF link annotation
- https://fategebedabeno.weebly.com/uploads/1/3/4/7/134718848/bcb576e4.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/cb9eb177-f9b6-4983-b99f-cabde9f1918c/58680978380.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/18238488-65a0-4fc2-b175-1e710dcace43/85994893596.pdfIn PDF document text
- https://s3.amazonaws.com/vekodupiwarobi/multivariable_calculus_early_transcendentals_3rd_edition.pdfIn PDF document text
- https://s3.amazonaws.com/zalomi/bugesulewenozusedebed.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/4b2c0c6f-1ee4-4e73-a8b5-98468fc34983/kamowizozo.pdfIn PDF document text
- https://s3.amazonaws.com/dazifozixawus/dojipukevosig.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/5800a54f-ec55-42e7-8d31-11cf052490dd/quantum_numbers_worksheet_key.pdfIn PDF document text
- https://s3.amazonaws.com/figugipopar/38762496461.pdfIn PDF document text
- https://s3.amazonaws.com/rawesaragegugar/aladdin_full_movie_2019_online_free.pdfIn PDF document text
- https://s3.amazonaws.com/gebaxovudofe/gijosinuxur.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.