PDF malware analysis — malicious · 570c59cf1f783489

MALICIOUS

PDF

MD5: 6be899e84cdf34eb8c1d55b3f7b17a3b SHA-1: f81e90f9ce886e1e55eef9b3bc5b4812451aa364 SHA-256: 570c59cf1f783489a4dc7a7e2e226137388a9d5bada685727764b432f52984ac

62 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file was detected by ClamAV as Pdf.Dropper.Agent-7213156-0, indicating it functions as a dropper. It contains an embedded external URI pointing to 'https://mariadeabreu.cf'. The document body is heavily obfuscated and unreadable, suggesting the primary malicious functionality is likely within the embedded URI or potentially in non-displayed content. The presence of an external URL and the dropper classification strongly suggest the file's purpose is to download and execute a secondary payload.

Machine Learning

Nyx PDF Classifier clean score 0.0127

Heuristics 3

ClamAV: Pdf.Dropper.Agent-7213156-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Dropper.Agent-7213156-0
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL https://mariadeabreu.cf

Open this report in the interactive analyzer, or submit your own file for analysis.