PDF malware analysis — malicious · 51adf944de2ee6ea

MALICIOUS

PDF

36.1 KB Authoring application: PDF Studio

MD5: 1c1d5ed373070da855453b2424222dd8 SHA-1: bf1d6b1c5d2d26971ec6bc1b000515c7cf0c40e2 SHA-256: 51adf944de2ee6eab3405f0917c842774a06f6e90873783be81462bd924012fd

92 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell

The file is a PDF that contains multiple embedded URLs pointing to other PDF or HTML files. The document body text indicates an attempt to trigger a file upload, likely to lure the user into downloading further malicious content. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' strongly suggests a phishing or malicious redirection campaign.

Machine Learning

Nyx PDF Classifier malicious score 0.9998

Heuristics 3

ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://theblockhousecafe.com/uploads/1/3/0/5/130588517/7c6a5c48b5dab4.pdf
- http://1695river.com/uploads/1/3/0/6/130639021/df6205eec7.pdf
- http://modusmarketseurope.com/uploads/1/3/0/4/130488244/20423.pdf
- http://readyplayerone.store/uploads/1/3/0/6/130620882/gubisajep_jujen_nukiza.pdf
- http://cyclebavaria.com/uploads/1/3/0/6/130639845/130639845.html#file+upload+accept+docx

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_001_off00001085.bin` `062b1f9b4123ba7d292e717f37ce47901e3f7a2440436eaf044aa93280ed9fa2`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x1085	9364 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.