PDF malware analysis — malicious · f3125546891a0be2

MALICIOUS

PDF

50.6 KB Created: 2021-01-10 08:02:56 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: a4d4a0b8599e8edc15341c921d375282 SHA-1: 6ea7b57aa77efd68b3bc7e56985727b2e8de8e3b SHA-256: f3125546891a0be212d12dd7551d602eaa219c2e76230c8bce92be4b09615bf1

94 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The file is a PDF document that contains embedded URLs, one of which is flagged as malicious. ClamAV detected this file as Pdf.Phishing.Trojan, and a machine learning classifier also flagged it as malicious. The document body text, though heavily obfuscated, appears to be a lure related to 'Vcds 409. 1 full', directing users to a suspicious URL.

Machine Learning

Nyx PDF Classifier malicious score 0.7482

Heuristics 3

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://trafficel.ru/aws?utm_term=vcds+409.+1+full
- https://cdn.sqhk.co/gukawaki/c7gh8aE/facts_about_cuba_s_government.pdf
- https://cdn.sqhk.co/janonaset/Xpd9Uhh/blood_warriors_heads.pdf
- https://site-1195301.mozfiles.com/files/1195301/vaiana_an_innocent_warrior_lyrics.pdf
- https://cdn.sqhk.co/feripamapuv/6YLAeT1/affirmed_housing_los_angeles.pdf
- https://cdn.sqhk.co/lagitesavap/GoheBgi/89085450904.pdf
- https://site-1244835.mozfiles.com/files/1244835/mepesizekokufubenero.pdf
- https://s3.amazonaws.com/zupenafud/zekewatodimifufum.pdf
- https://s3.amazonaws.com/xiwevitox/python_print_format_string.pdf
- https://s3.amazonaws.com/dazinibonofobi/latest_bollywood_movies_watch_online.pdf
- https://s3.amazonaws.com/pululusodogi/noridafo.pdf
- https://s3.amazonaws.com/lakadutof/86958936466.pdf
- https://s3.amazonaws.com/bofake/23159077909.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.