PDF malware analysis — malicious · 49dd54553c22bda8

MALICIOUS

PDF

51.2 KB Authoring application: Mobipocket Creator

MD5: 66ed85a6972a508d21e176b520640071 SHA-1: d33d041fd3c139b4751a420cc02deb6a91362e37 SHA-256: 49dd54553c22bda8651e03e1f551807491348d887187a3ff3496e3e86159c403

62 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious File

The file is a PDF document that masquerades as a house cleaning rota template to trick users into downloading it. The document contains multiple embedded URLs pointing to other PDF files, suggesting a phishing or credential harvesting campaign. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports the phishing classification.

Heuristics 3

ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://growtem.com/uploads/1/3/0/2/130274088/b3e6c4e45efd34c.pdf
- http://pinkchard.com/uploads/1/3/0/5/130540118/miwejew-kurulekode-wuluminunemol-gonedoku.pdf
- http://bewateryogaandcoaching.com/uploads/1/3/0/6/130620416/sifalabozosojo_pudepesu_garizudome_sibonuxib.pdf
- http://minamohit.com/uploads/1/3/0/6/130621511/dexotuwew.pdf
- http://davesbackyardbees.com/uploads/1/3/0/7/130739996/9f470.pdf
- http://chewoncakes.com/uploads/1/3/0/5/130539492/130539492.html#house+cleaning+rota+template

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000116b.bin` `122235f9f670d72ad826cdc427455938adf7f76697ea23b48d72a2c7605a1d6d`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x116B	9096 bytes
`font_01_sfnt_off00008303.bin` `779aa567746046747dac965df7fdfb06ff632674a0a99ce247a327bf89f0fa63`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x8303	16036 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.