Malicious PDF — malware analysis report

Static analysis result for SHA-256 26e2b47fbd8090cc…

MALICIOUS

PDF

72.3 KB Created: 2018-06-12 15:34:18 +05:00 Authoring application: mPDF 6.0
MD5: 309483627d6b78402a210bff9d14da1e SHA-1: 2a98f80efbacdfd384a5fa8ab64e1956140bbb00 SHA-256: 26e2b47fbd8090cc78078bd76f4df43a4d33af913600a31bb9209bccefcaa24f
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains an embedded URI pointing to a suspicious domain, which is a common tactic for delivering malware or phishing content. ClamAV identified the file as 'Pdf.Dropper.Agent-7241157-0', indicating its dropper functionality. The embedded URL is likely used to download and execute a second-stage payload.

Machine Learning

  • Nyx PDF Classifier clean score 0.0010

Heuristics 3

  • ClamAV: Pdf.Dropper.Agent-7241157-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Dropper.Agent-7241157-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://xn---1-6kcad1b.xn--p1acf/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_002_off0000122d.bin
6a77809c74de4d07b268b55c72a07a6b5a601af2d7220bc5b10f651484ef66ba		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x122D 23148 bytes
font_01_sfnt_off000050ca.bin
c611941eb5332023c27542d22200b07aa13a67f0b354fecafe0d145490f753b8		 pdf-font-stream PDF embedded font (sfnt) at offset 0x50CA 22636 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.