PDF malware analysis — malicious · bf3b43f5e4398ac8

MALICIOUS

PDF

MD5: 2541bb9ab5f27edc433621d06c553c58 SHA-1: 9e0e65ea2e7c50f550208c176283f45912532b6d SHA-256: bf3b43f5e4398ac810f005200519e096349b2237587d920d3c9b83525bb6bafc

90 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 User Execution: Malicious File

The PDF is identified as malicious by an ML classifier and exhibits characteristics of a phishing lure, specifically an image-only document designed to trick users into clicking a link. The heuristic PDF_FILE_HOSTING_DOWNLOAD_LURE confirms that the embedded URL, https://files.catbox.moe/olyfi3.001, is intended to lead to a file download, which is a common delivery mechanism for further malicious payloads.

Machine Learning

Nyx PDF Classifier malicious score 0.9239

Heuristics 3

Image/button lure links to file-hosting download high PDF_FILE_HOSTING_DOWNLOAD_LURE

PDF is an image-only or near-image-only lure with a clickable action to a public file-hosting download endpoint. This is a common malware delivery pattern: the visible page is just a screenshot/button, while the real payload is fetched from the external hosting service.
Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE

PDF has 2 image(s), only 0 text block(s), carries a click-outward action, and is only 255 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL https://files.catbox.moe/olyfi3.001

Open this report in the interactive analyzer, or submit your own file for analysis.