MALICIOUS
94
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1204.002 Malicious File
The file is a PDF document that contains embedded URLs, one of which is flagged as malicious. The document body text, though heavily obfuscated, suggests a lure related to 'Krysta youngs vocal sample pack free', indicating a social engineering attempt to trick the user into downloading further malicious content. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports the phishing and malicious nature of this PDF.
Machine Learning
- Nyx PDF Classifier malicious score 0.9998
Heuristics 3
-
ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://mywonderowl.com/uploads/1/3/0/4/130476940/2456471.pdf PDF link annotation
- https://xiwexoripijux.weebly.com/uploads/1/3/0/5/130545985/9e0fde1f7cbd8.pdfIn PDF document text
- http://7sevensteps.com/uploads/1/3/0/5/130550998/nagaduzubugoz-pezefi-laluno-degusos.pdfIn PDF document text
- http://nyclanguageinstitute.com/uploads/1/3/0/5/130541131/jasosimir.pdfIn PDF document text
- http://stokesed508webpage.com/uploads/1/3/0/5/130588824/130588824.html#krysta+youngs+vocal+sample+pack+freeIn PDF document text
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off000010c0.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10C0 | 8744 bytes |
SHA-256: 9e9c0e9c4649d4c78721cb53888cbf12af6c9460a882fb3d607acad92e2ca006 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.