Malicious PDF — malware analysis report

Static analysis result for SHA-256 bf9d0aff42079978…

MALICIOUS

PDF

35.5 KB Created: 2015-08-28 20:43:04 +03:00 Authoring application: 1 (via Softplicity) First seen: 2021-08-20
MD5: 8a08d457e26675fe527198d60eac0efc SHA-1: 421109f4cdaecfc03aee370d10806cfa58fd4000 SHA-256: bf9d0aff42079978837d292805b16cfdc17134eb1acef153209d52a9934b33bc
64 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file contains an embedded URI pointing to a suspicious domain, which is also present in the document body. ClamAV identified the file as a known dropper. The embedded URL likely serves as a lure to download a second-stage payload, consistent with spearphishing attachment tactics.

Machine Learning

  • Nyx PDF Classifier clean score 0.0247

Heuristics 3

  • ClamAV: Pdf.Dropper.Agent-7611510-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Dropper.Agent-7611510-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://to.tomsorg.com/download.php?q=Ms-7184 PDF link annotation
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000023e4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x23E4 18892 bytes
SHA-256: 81ab0f7e1f6ace85061b04b714b2aa4be8d23e20e402e9d68e0b01f61c46ab38
font_01_sfnt_off000056aa.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x56AA 17664 bytes
SHA-256: 6adabd779bcab43443310a439079307322ecabf21904a5624cc542e28bbb79cf

Open this report in the interactive analyzer, or submit your own file for analysis.