PDF malware analysis — malicious · 226cf25e8cd377c6

MALICIOUS

PDF

5.4 KB Created: 2018-09-07 12:50:02 +03:00 Authoring application: dompdf + CPDF

MD5: e1caf638f2a66db81fb597074d768ab3 SHA-1: 2d1738090e11c8d3ecd426b4e8c7670abcc0e005 SHA-256: 226cf25e8cd377c60a59031e90217267b8e5b5781bf5b3d9027b4be329d67229

74 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a lure related to invoices and payments, directing the user to download an invoice from a suspicious URL. ClamAV detected this file as Pdf.Dropper.Agent-7238904-0, indicating it functions as a dropper. The embedded URL is the primary indicator for potential malicious payload delivery.

Heuristics 5

ClamAV: Pdf.Dropper.Agent-7238904-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Dropper.Agent-7238904-0
Fake invoice / payment lure low SE_INVOICE_LURE

Document contains invoice or payment language paired with an action verb — useful context when combined with link, macro, or attachment indicators
External URI info PDF_URI

PDF contains an external URL action
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://www.retro-jordans-for-sale.com/default/EN_en/Invoice-receipt

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_000_off00000268.bin` `0eee678fefb66c436d850c93f17847558066676dc3bb4d04cff0f50686479881`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x268	6447 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 16 long base64-like blob(s).

Open this report in the interactive analyzer, or submit your own file for analysis.