PDF malware analysis — malicious · 560e11b9651c9284

MALICIOUS

PDF

39.2 KB Authoring application: SWFTools

MD5: f9ca681bbe18398fee0869de1d5ec715 SHA-1: d3c151b4bc182a56f549579ad24731556a221a1d SHA-256: 560e11b9651c92848be6b38d68f0507c22c0b29e7fb9aaf0acc9ab0646354ba7

92 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

The file is a PDF document that contains multiple embedded URLs pointing to other PDF files and an HTML page. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the ML classifier strongly indicate malicious intent, likely phishing or malware distribution. The embedded URLs are the primary indicators of compromise, suggesting a lure to download further malicious content.

Machine Learning

Nyx PDF Classifier malicious score 0.9998

Heuristics 3

ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://197cedarrock.com/uploads/1/3/0/5/130589209/7114561.pdf
- http://johnrasberry.com/uploads/1/3/0/2/130288506/e17a9b.pdf
- http://ranchonicholls.com/uploads/1/3/0/7/130739238/781873.pdf
- http://rigis.prontoconsegna.it/uploads/2020/01/28/palexupuzodudin-jasenoziwirod-jowet-mukesajupuniv.pdf
- http://sweetestdreams.org/uploads/1/3/0/2/130272417/130272417.html#joomla+templates+premium+free

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00001038.bin` `5f84b6cba22fc41921cf702d1d160b8a2b4bf32333d22f775ba028cc138bcab4`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1038	8584 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.