PDF malware analysis — malicious · c8ec4d038c47018e

MALICIOUS

PDF

37.7 KB Authoring application: Solid Converter PDF

MD5: 82c32f7a7f0ab15b29df45d82ff73e08 SHA-1: 7c138e368346b3bbf8c8f0524599656f43763109 SHA-256: c8ec4d038c47018eeb7b8c6597c8927333b846bae4862782ff9b25881757524c

62 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The file is a PDF document that contains multiple embedded URLs pointing to other PDF files. The ClamAV heuristic indicates this is a phishing attempt, likely designed to trick users into downloading further malicious content. The document body itself is largely garbled but contains references to the embedded URLs, reinforcing the lure.

Heuristics 3

ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://nutgraf.ca/uploads/1/3/0/5/130539182/fagajebinul-mugomubupopudot-gazon.pdf
- http://voiceschorale.org/uploads/1/3/0/7/130775583/wawejufumurat.pdf
- http://churchofchrist-wellston.com/uploads/1/3/0/4/130435902/11a0f7c4b.pdf
- http://ndchair.com/uploads/1/3/0/5/130588816/130588816.html#s+u+bahn+plan+berlin+pdf

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00001005.bin` `7100b022203a5ed75464546d86b6e26239fe93e338463e88bdc09e968f5f9e57`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1005	9340 bytes
`font_01_sfnt_off0000584e.bin` `cf2338b7895a3a873add1db7dfb411390262a2a3d24e5b3dccff59843624ea97`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x584E	2704 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.