PDF malware analysis — malicious · cf3ded2550e672fd

MALICIOUS

PDF

37.2 KB Authoring application: Mobipocket Creator

MD5: 209b3a35789518fa0f59ea6c65b8e361 SHA-1: 55aa7f033af9198c4d5e21b85425c09d04bc9721 SHA-256: cf3ded2550e672fda16b556f97774745e05993293eaf1543b945c1be18eee70d

94 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment

The file is a PDF document that contains multiple external URIs pointing to other PDF files. The ClamAV detection and ML classifier strongly indicate malicious intent. The document body, though partially corrupted, suggests a lure related to job applications, aligning with phishing tactics.

Machine Learning

Nyx PDF Classifier malicious score 0.9998

Heuristics 3

ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://stevenrobinsonmusic.com/uploads/1/3/0/4/130436079/fodefaxebipisi_tujitezemotej_binikok_finewiwifad.pdf
- http://bolezni-zhivotnyh.online/uploads/2020/01/28/rakugox-sunevatite-gojemudepalegir-gagadazo.pdf
- http://vaguely-specific.com/uploads/1/3/0/7/130775347/f31154587c85cf9.pdf
- http://nickjanelandscape.com/uploads/1/3/0/3/130313108/4429c3.pdf
- http://blackmonmarshall.com/uploads/1/3/0/7/130740165/130740165.html#how+do+you+respond+to+a+job+rejection+email

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000125b.bin` `d66c11b9b2ce5e952f0daf9c9257e797f3fad71d3e798221ead2e0d42c09761b`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x125B	7908 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.