PDF malware analysis — malicious · 129d8c09af6be6dd

MALICIOUS

PDF

37.8 KB Authoring application: Karbon

MD5: ccf7f87866241b8ef1e415931371912c SHA-1: 809f8b59cd409816674c3373060bac1759feb15f SHA-256: 129d8c09af6be6dd7f3482aade28ad1df9f97a634700a924c1899d4cf19a3328

94 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains embedded URLs that lead to other PDF files, suggesting a phishing or malware distribution scheme. The ML classifier and ClamAV detection strongly indicate malicious intent, likely related to phishing or malware delivery. The presence of embedded URLs points towards a technique of luring users to download further malicious content.

Machine Learning

Nyx PDF Classifier malicious score 0.9998

Heuristics 3

ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://anarchistflags.com/uploads/1/3/0/5/130551772/84650ce1d22.pdf
- http://dafyjor.store/uploads/1/3/0/4/130435602/1066605.pdf
- https://saburujadise.weebly.com/uploads/1/3/0/5/130590716/be9fc89b8bb3.pdf
- http://carlocornelli.com/uploads/1/3/0/4/130488820/zozunewuvinetow_duvevixu_sizesekig.pdf
- http://drpatty.net/uploads/1/3/0/7/130740461/130740461.html#exercises+to+avoid+during+groin+strain

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000105c.bin` `c67a51ca3d21ac912e9705382305414f2b8bc00d0f0cd96418b02eec3d1eb6ec`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x105C	8468 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.