PDF malware analysis — malicious · 74c9ceab711e5608

MALICIOUS

PDF

37.1 KB Authoring application: PDF Studio

MD5: 640c251c7bfb8a43fdc04a24370d16cd SHA-1: 0aea105b82d8d15b9793eeb9d61c21526e4956bf SHA-256: 74c9ceab711e560801dbc269fdc47a3cf0ce0c2e14864f2ba2994339a5cf5f5c

94 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF containing embedded URLs that point to other PDF or HTML files hosted on external domains. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the ML classifier strongly indicate malicious intent, likely phishing or malware distribution. The embedded URLs are the primary indicators of compromise, suggesting a multi-stage attack where this PDF acts as a lure.

Machine Learning

Nyx PDF Classifier malicious score 0.9998

Heuristics 3

ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://rosshousemuseum.ca/uploads/1/3/0/6/130603941/6536689.pdf
- http://morrowproperties.net/uploads/1/3/0/6/130604230/jobidedurokexozeware.pdf
- http://mybestieswholesale.com/uploads/1/3/0/7/130739596/f000b6.pdf
- http://5dsottozero.com/uploads/1/3/0/6/130620931/90f89c1e91.pdf
- http://coachparent.com/uploads/1/3/0/2/130291449/130291449.html#how+to+delete+pdf+pages+in+adobe+acrobat+dc

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00000ff4.bin` `e32c33e81ce60a0eadcd6fbd53ef4ea3a93bde842d77792497ac0d500795ccc3`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xFF4	7660 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.