PDF malware analysis — malicious · f81c9c45fa5a3846

MALICIOUS

PDF

51.8 KB Created: 2020-12-23 01:11:41 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-06-13

MD5: e413c2541f5475534f35e37e85b3fd02 SHA-1: 3d9532126e7862dc00a06f2d6c8197d0475d63db SHA-256: f81c9c45fa5a38469b4fcb459565e2158fd85b80846d55eb9d05fe18fce2522b

94 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The file is a PDF document that contains an embedded URL. The document body, though heavily obfuscated, contains text that appears to be a lure related to biological processes. The embedded URL likely leads to a malicious site, as indicated by the ClamAV detection and ML classifier flagging this PDF as malicious. No scripts were extracted from this sample.

Machine Learning

Nyx PDF Classifier malicious score 0.6878

Heuristics 3

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://trafficel.ru/aws?utm_term=zygote+formation+in+fallopian+tube PDF link annotation
- https://cdn-cms.f-static.net/uploads/4380080/normal_5f8e4394e75d9.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4379742/normal_5fa01db682ae8.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4407997/normal_5fb2ca1db13a1.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4464303/normal_5fc71ec443cb4.pdfIn PDF document text
- https://s3.amazonaws.com/kigavanus/clocks_coldplay_guitar.pdfIn PDF document text
- https://s3.amazonaws.com/tobobowu/ben_hur_2010_ita.pdfIn PDF document text
- https://s3.amazonaws.com/lopadivupudexa/batuan_sedimen_karbonat.pdfIn PDF document text
- https://s3.amazonaws.com/sazariwapa/kebidutugizoberow.pdfIn PDF document text
- https://s3.amazonaws.com/fenatagazise/all_video_player_free_for_pc.pdfIn PDF document text
- https://static1.squarespace.com/static/5fe12c38d17c8b74f75b9d7d/t/5fe20f96c8074b5b088dac68/1608650647556/splashtop_personal_mod_apk.pdfIn PDF document text
- https://s3.amazonaws.com/dikobepibelun/ejemplo_de_acta_constitutiva_llena.pdfIn PDF document text
- https://s3.amazonaws.com/julexekubaj/biomagnification_of_pesticides.pdfIn PDF document text
- https://s3.amazonaws.com/zukukelejurotef/badger_aquatics_club_madison_wi.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.