PDF malware analysis — malicious · f18c78d5342e7672

MALICIOUS

PDF

132.8 KB Created: 2021-06-15 10:28:23 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-24

MD5: e60b8f879208e38e179baf257cded2df SHA-1: 4260cbf7f8360f80e5ea6910cddbc4c3e3b9eabe SHA-256: f18c78d5342e7672995ddd1b8efbbff6432ffcddf1887c0d4e24f0057db9a64b

64 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The file is identified as malicious by ClamAV with a signature indicating it is a phishing trojan. It contains an embedded URI pointing to a URL that suggests downloading Android Studio for PC, likely a lure for users seeking software. No scripts were extracted from this sample, but the presence of the malicious URI and the ClamAV detection strongly suggest a phishing or malware distribution attempt.

Machine Learning

Nyx PDF Classifier suspicious score 0.2941

Heuristics 3

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL https://medvor.ru/uplcv?utm_term=android+studio+apk+for+pc PDF link annotation

Open this report in the interactive analyzer, or submit your own file for analysis.