PDF malware analysis — malicious · 8f75a397cebd284f

MALICIOUS

PDF

235.8 KB Created: 2010-02-19 19:39:51 Authoring application: Joomla! 1.5 - Open Source Content Management (via TCPDF 2.5.000_PHP4 (http://www.tcpdf.org))

MD5: f2f07facebce9d9b7f55ebedd1711596 SHA-1: 3af03684e6094ba02b821a3b0301e80b7bc91683 SHA-256: 8f75a397cebd284ff670406f1e55c7613d00b3539098165c9ce597f73a0a57fe

70 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a hidden external HTML iframe, a common technique for redirecting users to malicious sites. The ML classifier also flagged this PDF as malicious. The embedded URLs point to suspicious domains, likely used for hosting malware or phishing content. No scripts were extracted from this sample, limiting the ability to determine specific payload delivery or persistence mechanisms.

Machine Learning

Nyx PDF Classifier malicious score 0.9482

Heuristics 2

PDF contains hidden external HTML iframe high PDF_HIDDEN_HTML_IFRAME

PDF bytes contain a hidden zero-size HTML iframe pointing to an external HTTP(S) URL. This is a strong malicious dropper/redirect indicator and is not expected in ordinary PDF content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://fuadrenal.com/lib/index.php
- http://reycross.com/lib/index.php
- http://odmarco.com/lib/index.php

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_002_off0000b9ed.bin` `a5337ef1f5a0dfe4dc8fa6b4f3ef847a53624800b5928a0eeef5b888ceecaabc`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0xB9ED	264072 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.