PDF malware analysis — malicious · 435013096e25ee36

MALICIOUS

PDF

145.1 KB Created: 2017-11-22 20:14:21 +01:00 Authoring application: Microsoft® Word 2010

MD5: 4a729b88936d748ae524250ef595db31 SHA-1: 9b56efdcac57bf57af877de15c3200a6311499c9 SHA-256: 435013096e25ee367f25aa5b235729e7a4fffc80a2c3a0b4343d65597b097c06

82 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file is identified as a malicious dropper by ClamAV. Static analysis indicates it's an image-only document designed as a lure, with a clickable action pointing to the URL http://techtul.info/rudra1/wait.php?stuff=v. This suggests the document's primary purpose is to redirect the user to a potentially malicious external resource.

Machine Learning

Nyx PDF Classifier clean score 0.0037

Heuristics 4

ClamAV: Pdf.Dropper.Agent-7255196-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Dropper.Agent-7255196-0
Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE

PDF has 2 image(s), only 2 text block(s), carries a click-outward action, and is only 145 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://techtul.info/rudra1/wait.php?stuff=v

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_003_off0000e389.bin` `a61e6d0c57f391948e4ee358d2c167a240c244a7ada9cedfe6b55e7bf06f09db`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0xE389	188952 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.