PDF malware analysis — malicious · b2ae362d35939e99

MALICIOUS

PDF

32.5 KB Authoring application: Solid Converter PDF

MD5: ef33e7ac12fc2651f3bddc87d5ff5c1a SHA-1: 5bb32648ff959fe098f192a5d4fdfabd699fd719 SHA-256: b2ae362d35939e991fd946418ab40880c2c36c81d2a831427c3e0b1c5a61ea47

92 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious File

The file is a PDF containing multiple embedded URLs, identified by the PDF_URI heuristic. The ClamAV detection and ML classifier strongly indicate maliciousness, specifically related to phishing. The document body, though truncated, contains text related to medical conditions, likely a lure to disguise the malicious intent of the embedded links. The primary attack pattern involves directing the user to download further malicious content via these URLs.

Machine Learning

Nyx PDF Classifier malicious score 0.9995

Heuristics 3

ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://disruptioneer.com/uploads/1/3/0/5/130588923/vudodof.pdf
- http://vosalepuve.tashermer.xyz/uploads/2020/01/29/2617128.pdf
- http://oedipa-maas.com/uploads/1/3/0/5/130550809/1440b60a0.pdf
- http://nicolitulk.com.au/uploads/1/3/0/2/130289524/130289524.html#pleural+effusion+exudate+transudate

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00000fb4.bin` `6dfca147222fbc4cd322a5b7816df2ce80b71e8c6a2bb6ccb0ee036339d1564a`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xFB4	8216 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.