PDF malware analysis — malicious · ff330ccdcb928a39

MALICIOUS

PDF

45.1 KB Created: 2021-03-26 08:01:21 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: c28d28bfe57b79fbc97d5127e9625904 SHA-1: bbcf727028c45e70c34c412390e7f54c4e360bc5 SHA-256: ff330ccdcb928a39c282a9cf86ee4d24870a64e2bb592327993c4b8b17b78a87

114 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF file is identified as malicious by a machine learning classifier and ClamAV, with a high heuristic score for being an image-only document used as a lure. The embedded URI points to a suspicious domain, suggesting a phishing or malware distribution attempt. The document body is heavily obfuscated, preventing a detailed analysis of its specific content, but the overall structure and heuristics indicate a malicious intent to redirect the user to an external resource.

Machine Learning

Nyx PDF Classifier malicious score 0.7134

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE

PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 45 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://xajibur.ru/123?utm_term=sales+forecast+template+for+restaurant
- http://wavokumad.iblogger.org/canon_pixma_ip90v_photo_inkjet_printer.pdf
- http://grafoanaliz.ru/diono_radian_rxt_rear_facing_bases27c2.pdf
- http://davavemoj.66ghz.com/sparkle_background_free.pdf
- http://carinsusa.info/spectrum_math_workbook_grade_8_free92cvz.pdf
- http://christmas-gift.ru/resumen_de_lazarillo_de_tormes_tratado_5_6_y_7kcubv.pdf
- https://uploads.strikinglycdn.com/files/e342185d-c211-4f07-84c8-8500a6490085/how_to_pair_dell_km632_keyboard.pdf
- https://uploads.strikinglycdn.com/files/dbf456d2-e85d-48da-838b-8b5afb1789e0/regarder_warm_bodies_streaming_vf.pdf
- https://uploads.strikinglycdn.com/files/f6259a9f-aa0f-428e-a4ef-cd22883c3a55/girl_jamaica_kincaid_espaol.pdf
- https://uploads.strikinglycdn.com/files/7583d520-5608-4178-bde6-a79c607d39fe/war_of_the_worlds_2019_streaming_australia.pdf
- https://uploads.strikinglycdn.com/files/2b7b7551-07a3-469c-991f-ccc7923c8307/zatoleme.pdf
- https://s3.amazonaws.com/patotale/36226116437.pdf
- https://uploads.strikinglycdn.com/files/e512d6f1-e21a-4066-a296-7b6fe2a6b07e/comentario_literario_de_20_poemas_de_amor_y_una_cancion_desesperada.pdf
- http://tuludad.rf.gd/dabewoxunulogiwojavodemaf.pdf
- https://uploads.strikinglycdn.com/files/e72f8a89-e0bd-4831-8d49-d57ebe580603/walter_riso_desapegarse_sin_anestesia.pdf
- https://uploads.strikinglycdn.com/files/9a794e13-2125-4ba8-b047-6ec1c7138d9f/what_was_the_radical_republicans_ideas_for_the_south.pdf
- https://s3.amazonaws.com/voxazedisula/gupupelinev.pdf
- https://uploads.strikinglycdn.com/files/4dc719ae-f162-4470-8d67-c0ed821badb0/big_blue_live_stream.pdf
- http://vopezaxaf.epizy.com/wivemitatalazadizofavidab.pdf
- https://s3.amazonaws.com/jajuzasalikirut/irs_reporting_agent_forum.pdf
- https://s3.amazonaws.com/nawosineromigi/38777306394.pdf
- https://s3.amazonaws.com/musoxifuvitalo/68032567457.pdf
- https://uploads.strikinglycdn.com/files/78fb0d94-e53a-465c-bf76-095a2c2d8a3d/safety_first_expiration_date.pdf
- https://uploads.strikinglycdn.com/files/bbcae0f9-27c6-45cb-859e-a8ff181791f8/wowetigurenajibidef.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.