PDF malware analysis — malicious · 9e151a4bd3355f29

MALICIOUS

PDF

38.7 KB Authoring application: Solid Converter PDF

MD5: 0d642178013dc22f6c341a187cdb03ea SHA-1: 4d3a12d0dfd52f8ba66a4522fa22804715d2819d SHA-256: 9e151a4bd3355f29bca22f410bf08c768f2a3531193038eb9608e9223b6bb5e6

92 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

The file is a PDF document that contains multiple embedded URLs pointing to other PDF files and an HTML file. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the ML classifier strongly indicate malicious intent, likely phishing or malware distribution. The embedded URLs are the primary indicators of compromise, suggesting a lure to download further malicious content.

Machine Learning

Nyx PDF Classifier malicious score 0.9995

Heuristics 3

ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://mitchgallagherband.com/uploads/1/3/0/5/130543543/1673c56108.pdf
- http://sonriseseattle.org/uploads/1/3/0/4/130435982/pulufimifogof.pdf
- http://lanechnge.org/uploads/1/3/0/6/130620917/managexag_davemesitaxaf.pdf
- http://mynaturalhairspa.com/uploads/1/3/0/4/130476462/130476462.html#hx+of+alcoholic+pancreatitis+icd+10

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00000fcb.bin` `d9f531f664e86e14e5f2b9db125a3572077fca6f363e00992ea286179d35befe`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xFCB	7692 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.