Malicious PDF — malware analysis report

Static analysis result for SHA-256 910cf65f5bfe50bd…

MALICIOUS

PDF

42.1 KB Created: 2015-08-28 20:25:09 +03:00 Authoring application: 1 (via Softplicity)
MD5: b5ab7c05343379a5951a6bb6e642da3c SHA-1: 0c521e56b8d87841c0f361c993aa5c6646a3abbc SHA-256: 910cf65f5bfe50bdcaf1809b9a65960042d3c060361c1d0f2c1b4a70f816b15a
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF file contains a lure referencing a 'Marsh Unicorn Printer User Manual' and includes an external URI pointing to 'http://to.tomsorg.com/download.php?q=Marsh'. This URL is likely used to deliver a secondary payload. ClamAV detection as 'Pdf.Dropper.Agent-7612834-0' further confirms its malicious nature as a dropper.

Machine Learning

  • Nyx PDF Classifier clean score 0.0473

Heuristics 3

  • ClamAV: Pdf.Dropper.Agent-7612834-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Dropper.Agent-7612834-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://to.tomsorg.com/download.php?q=Marsh
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_004_off000033c9.bin
c6ab32f518087c01cb7258401a6ed587fd2af84aee6a69667fa939e7cbfc09e4		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x33C9 21412 bytes
font_01_sfnt_off00006d11.bin
4b85ccaa9bf2747de5064b6d3e5d0e05b1a1dab8de459e59f091a4cd273d2ccb		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6D11 18868 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.