Malicious PDF — malware analysis report

Static analysis result for SHA-256 9adcf38eb5551b49…

MALICIOUS

PDF

283.9 KB Created: 2010-02-07 22:10:13 +01:00 Authoring application: LaTeX with hyperref package (via xdvipdfmx (0.6))
MD5: 8bc6bf3e1ecc8cd0579b709e7f2ae572 SHA-1: 91202341233a58e304a2270319185a0c492f4be8 SHA-256: 9adcf38eb5551b49f3945f48cabbb0e6c374db329e0660cab7240820685e8c33
62 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The ClamAV heuristic identified this file as Win.Trojan.Dropper-134, indicating it likely functions as a dropper for other malware. An external URI, http://www.foo.be/, was extracted, which could be used to download additional malicious payloads. The PDF structure also contains embedded URI information, further supporting the dropper hypothesis.

Heuristics 3

  • ClamAV: Win.Trojan.Dropper-134 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Win.Trojan.Dropper-134
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.foo.be/
    • http://www.gitorious.org/~adulau

Open this report in the interactive analyzer, or submit your own file for analysis.