PDF malware analysis — malicious · 3c72bb18178af35b

MALICIOUS

PDF

36.5 KB Authoring application: ImageMagick

MD5: a0dfa71f4a634489fd2a451811d9de92 SHA-1: 16314b4ed9f2ee5815fd64208a2494668ac669e5 SHA-256: 3c72bb18178af35bebdb9c010cfe08675148d68c1a78b605f17adea622a9d228

92 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious File

The file is a PDF document identified as malicious by ClamAV and an ML classifier. It contains an embedded URI pointing to an external PDF file, suggesting a phishing or malware delivery attempt. The document body, though largely obfuscated, contains the same URL, reinforcing the attack pattern.

Machine Learning

Nyx PDF Classifier malicious score 0.9998

Heuristics 3

ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://offpeaktraining.net/uploads/1/3/0/5/130544790/wemiwofeb-lefinodulukul-rolekejubulinaj-metusotiwubif.pdf
- http://ssejinja.weebly.com/uploads/1/3/0/6/130639337/5869807.pdf
- http://idealmedikal.com/uploads/1/3/0/4/130491947/gevejog_merekesedogojo_moxadelen_paxosokuz.pdf
- http://redskinscheerleaderalumni.com/uploads/1/3/0/6/130604401/0cbf980ab.pdf
- http://sqeda.com/uploads/1/3/0/2/130289748/130289748.html#alpine+linux+3.+8

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000010c8.bin` `524b6fcbf22f3cc51e1aa1b1cc7f6dc4662850287fe8a19ccc64518545662a31`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x10C8	9264 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.