Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Dropper.Agent-7229234-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Dropper.Agent-7229234-0
• Invisible/repeated PDF links deliver payload file critical PDF_REPEATED_PAYLOAD_LINK_LURE
  PDF uses invisible link annotations and points to a direct payload download. Repeated invisible links or lure-like payload names such as document/unlock/verify archives match malware-delivery PDF carriers where the page is only a prompt and the real payload is fetched from the linked URL.
• Clickable URI uses URL shortener medium PDF_URL_SHORTENER_URI
  PDF contains a clickable HTTP(S) action whose destination is a URL shortener. This hides the final landing page from static review and is common in phishing redirect PDFs.
• Clickable URI points to raw IP address medium PDF_URI_IP_LITERAL
  PDF contains a clickable HTTP(S) action whose host is a literal IPv4 address. Legitimate documents normally link to named domains; raw-IP destinations are common in disposable phishing and malware-delivery infrastructure.
• Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
  Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL http://67.23.226.12/~britcous/curtis/PAYMENT_SWIFT_TT_COPY_SCA.scr PDF link annotation

  • http://ocsp.verisign.com0In PDF document text
  • http://tinyurl.com/nv66estIn PDF document text
  • http://www.iec.chIn PDF document text
  • http://www.microsoft.com/typography/ctfontshttp://fontfabrik.comYouIn PDF document text
  • http://www.microsoft.com/typography/fonts/default.aspxIn PDF document text
  • http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl0ZIn PDF document text
  • http://www.microsoft.com/pki/certs/MicCodSigPCA_08-31-2010.crt0In PDF document text
  • http://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl0XIn PDF document text
  • http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0In PDF document text
  • http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0TIn PDF document text
  • http://www.microsoft.com/pki/certs/MicrosoftRootCert.crt0In PDF document text
  • http://www.microsoft.com/typographyIn PDF document text
  • http://crl.verisign.com/ThawteTimestampingCA.crl0In PDF document text
  • http://crl.verisign.com/tss-ca.crl0In PDF document text
  • http://crl.microsoft.com/pki/crl/products/CodeSignPCA2.crl0OIn PDF document text
  • http://www.microsoft.com/pki/certs/CodeSignPCA2.crt0In PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.