PDF malware analysis — malicious · 3fc5dd507d7d93e3

MALICIOUS

PDF

185.8 KB Created: 2017-11-17 12:14:47 -08:00 Authoring application: Microsoft® Word 2016

MD5: 93420015981f012e71cf27d0a782cc11 SHA-1: 1827d9d27e6f6b12601ee6da59592e00f1ae292f SHA-256: 3fc5dd507d7d93e36f1423f61c12c1f040b07db718920c7976e408e308cc8511

82 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file is detected as a dropper by ClamAV and exhibits characteristics of a phishing lure, specifically an image-only document designed to conceal a clickable action. The heuristic 'PDF_IMAGE_LURE' indicates that the document is primarily image-based and contains a click-outward action, typical of phishing attempts. An external URI, http://www.financialdoc.net/e-finance/fonts, was extracted, which is likely the malicious destination.

Machine Learning

Nyx PDF Classifier clean score 0.0239

Heuristics 4

ClamAV: Pdf.Dropper.Agent-7253455-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Dropper.Agent-7253455-0
Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE

PDF has 2 image(s), only 0 text block(s), carries a click-outward action, and is only 185 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://www.financialdoc.net/e-finance/fonts
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://ns.adobe.com/pdf/1.3/
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/

Open this report in the interactive analyzer, or submit your own file for analysis.