PDF malware analysis — malicious · 7a5c189ad89a28de

MALICIOUS

PDF

29.2 KB Authoring application: pstoedit

MD5: cdbefbf4714879aba9b2a3d3b49046be SHA-1: 69e2ff1a3b2d4f82843c7a7f90d057f18a0f940f SHA-256: 7a5c189ad89a28de2f9575691d4c76dc3ae49f34f263c6d05be7ff2d4d50a192

94 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF that contains embedded URLs pointing to other PDF files, suggesting a phishing or redirection attempt. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the ML classifier strongly indicate malicious intent, likely related to phishing or malware distribution. The presence of external URIs and embedded URLs supports the attack pattern of luring users to malicious content.

Machine Learning

Nyx PDF Classifier malicious score 0.9994

Heuristics 3

ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://livingthepondlife.org/uploads/1/3/0/6/130621446/103f76e3e.pdf
- http://silverliningssociety.com/uploads/1/3/0/4/130435930/semanuvedexufex.pdf
- http://dfpinvestments.com/uploads/1/3/0/5/130588839/wevofipuxeje.pdf
- http://sauerlandhypotheek.nl/uploads/1/3/0/7/130738769/130738769.html#plastic+dust+sheets+homebase

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00000f91.bin` `4b544eb8293a4e9f9d6c5dafa6d7235e8526f06f8f7b762ef5ac508276c48439`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF91	8084 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.