PDF malware analysis — malicious · 39fe62c94ca9411d

MALICIOUS

PDF

73.5 KB Created: 2018-06-12 15:41:42 +05:00 Authoring application: mPDF 6.0

MD5: 9e32cdc03dc8435baf573f9bebf2fb79 SHA-1: b1fd1c5f06bc7a70c19b62c0710d1dbf9ecdc12f SHA-256: 39fe62c94ca9411d938b32f53e85f354bd9bd67d4097e56b77563902cd69cae4

62 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains an embedded URI pointing to a suspicious domain, and ClamAV detected it as a dropper. The embedded URL is likely intended to redirect the user to a malicious site for further exploitation or malware delivery. The document body, though heavily obfuscated, contains references to the same URL.

Machine Learning

Nyx PDF Classifier clean score 0.0010

Heuristics 3

ClamAV: Pdf.Dropper.Agent-7250633-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Dropper.Agent-7250633-0
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://xn---1-6kcad1b.xn--p1acf/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_002_off0000122b.bin` `6a77809c74de4d07b268b55c72a07a6b5a601af2d7220bc5b10f651484ef66ba`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x122B	23148 bytes
`font_01_sfnt_off000050c8.bin` `c611941eb5332023c27542d22200b07aa13a67f0b354fecafe0d145490f753b8`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x50C8	22636 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.