Malicious PDF — malware analysis report

Static analysis result for SHA-256 67570c27cd1b5406…

MALICIOUS

PDF

125.7 KB
MD5: 1f2f8ef7ef26460aef07e37e61c8c3ab SHA-1: 6d065436b2bb3a415c482db0f4cac8c2c47f8d6d SHA-256: 67570c27cd1b5406dcb8bc2111d73636bbc237e770942c58114842790f0a8d88
72 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains an embedded URI pointing to 'http://x.co/6nFZl', which is flagged as unknown reputation. The heuristic 'SE_URGENCY_LURE' indicates the document uses language to create a sense of urgency, such as 'account will be terminated' or 'action required within 24 hours'. ClamAV detection 'Pdf.Dropper.Agent-7268379-0' further confirms its malicious nature, suggesting it acts as a dropper for other malware. No scripts were extracted, but the combination of an external link and urgency lure strongly suggests a phishing or malware delivery attempt.

Machine Learning

  • Nyx PDF Classifier clean score 0.0060

Heuristics 4

  • ClamAV: Pdf.Dropper.Agent-7268379-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Dropper.Agent-7268379-0
  • Urgency / deadline lure low SE_URGENCY_LURE
    Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://x.co/6nFZl
    • http://www.tcpdf.org
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_008_off000067c3.bin
6e1c6126235fe0eb596c8506069b4b059a091cec4c460b9f46ebb91482a6b35d		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x67C3 54940 bytes
stream_015_off000129a7.bin
8335b253cde28e86d258bfc4cac8ee6fec6d352cca8d902780bbd8e279ee671a		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x129A7 59312 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.