PDF malware analysis — malicious · a699a56e454211c9

MALICIOUS

PDF

35.7 KB Authoring application: pdf-parser

MD5: f5fbdfac4b04b50d6ab5ecfde42ecc48 SHA-1: e39b5a793ad83454496ab644e6a7f80781b884bc SHA-256: a699a56e454211c914bb47bf277a41742c3dbe8e6fd434f730bf6e8469bcecd9

92 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

The file is a PDF containing multiple embedded URLs that point to other PDF or HTML files. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the ML classifier strongly indicate malicious intent, likely phishing or malware distribution. The embedded URLs are the primary indicators of compromise, suggesting a redirection to malicious content.

Machine Learning

Nyx PDF Classifier malicious score 0.9998

Heuristics 3

ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://oginnovate.com/uploads/1/3/0/4/130476859/9159237.pdf
- http://dripexperience.com/uploads/1/3/0/5/130551186/vadewurotavozubolu.pdf
- http://meredithbirrell.com/uploads/1/3/0/5/130546000/536134.pdf
- http://berob.htools.ua/uploads/2020/01/28/14c2b590b110.pdf
- http://juliejesternewman.com/uploads/1/3/0/2/130288502/130288502.html#solomon+and+sheba+1959+full+movie

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00001046.bin` `d5f4cf46467208066e04ea5408ca924ba071417471c668be32245396b43cd612`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1046	8708 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.