PDF malware analysis — malicious · ab1351669f709091

MALICIOUS

PDF

46.4 KB Authoring application: Karbon

MD5: 8be0c554a63a65e8f7ade4de57c16cb3 SHA-1: d82a45028ca16242c1cf57e5075b4876dbc3e587 SHA-256: ab1351669f70909156d3004d7e588ad725aa03c34b8f4d3a1ec07470fee445e8

62 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment

The PDF file contains embedded URLs that lead to other PDF files, suggesting a phishing or redirection attempt. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a phishing classification. The document body, though partially corrupted, mentions 'Home ownership costs spreadsheet' as a lure.

Heuristics 3

ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://stephaniehazel.com/uploads/1/3/0/2/130287311/xoxanamu-doporakedad-rofelutusa.pdf
- http://jennifferdiaz.com/uploads/1/3/0/7/130739751/2120872.pdf
- http://ncexchangeclub.com/uploads/1/3/0/6/130621701/4153097.pdf
- http://nicolitulk.com.au/uploads/1/3/0/6/130621846/130621846.html#home+ownership+costs+spreadsheet

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00001014.bin` `71b9bdcefc58f25105f000bde9c496139e38aae20d32352babfc7539f559a49e`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1014	9236 bytes
`font_01_sfnt_off00006ffa.bin` `779aa567746046747dac965df7fdfb06ff632674a0a99ce247a327bf89f0fa63`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6FFA	16036 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.