Malicious PDF — malware analysis report

Static analysis result for SHA-256 53d99ba7d9c4b705…

MALICIOUS

PDF

68.8 KB
MD5: 67d3ab41da66040a7a8441d39d621b93 SHA-1: ed18e9aa727922021ff19d8a9c83b5b057134ade SHA-256: 53d99ba7d9c4b705031ca0cb689711de06b8d6841910d829aa00daa670e2a54c
60 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1566.002 Spearphishing Attachment

The PDF file exhibits obfuscated object names, a common technique used to evade detection. It also contains an embedded URL, http://www.bitstream.com, which is likely part of a phishing or malware distribution scheme. The document body is heavily obfuscated and does not provide clear textual lures, suggesting the primary intent is to exploit the embedded URL or exploit a vulnerability within the PDF reader itself.

Heuristics 2

  • ClamAV: Heuristics.PDF.ObfuscatedNameObject critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Heuristics.PDF.ObfuscatedNameObject
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.bitstream.com

Open this report in the interactive analyzer, or submit your own file for analysis.