PDF malware analysis — malicious · ab6a2c204eb9779f

MALICIOUS

PDF

36.8 KB Authoring application: LibreOffice Draw

MD5: 0b1bf51a787d0083d5432be2c96113cf SHA-1: 8bedcaf2a1b9a8793b8868124c1c42409f598ed1 SHA-256: ab6a2c204eb9779fd7a182dad425e77f3311d01747595fab19eb97e1dac848d1

92 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious File

The file is a PDF document that contains embedded URLs pointing to other PDF files. The document body discusses reducing ecological footprint, likely as a lure. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the ML classifier strongly indicate malicious intent, consistent with phishing or malware distribution. The embedded URLs are the primary indicators of compromise.

Machine Learning

Nyx PDF Classifier malicious score 0.9995

Heuristics 3

ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://tonyvu.io/uploads/1/3/0/7/130776504/40e2ace3ee480.pdf
- http://psychotherapeute-paris.net/uploads/1/3/0/6/130639896/8cbe56ea51a.pdf
- http://bayareaindustrialland.com/uploads/1/3/0/5/130588424/fikizojijozalosijero.pdf
- http://ne-surgerycenter.net/uploads/1/3/0/2/130273798/130273798.html#how+to+reduce+your+ecological+footprint+services

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00000ffb.bin` `4661c05a275293317e583295d9be955fb15e50dd0c44261905dba26f96833953`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xFFB	8112 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.