MALICIOUS
124
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious Link
The PDF file contains an image-based lure, typical of phishing, with a clickable action that links directly to a malicious MSI installer. The embedded URL points to a file-hosting service, suggesting the document's primary purpose is to facilitate the download of a second-stage payload. The heuristic firings strongly indicate a malicious intent to trick the user into executing a downloaded file.
Machine Learning
- Nyx PDF Classifier clean score 0.0003
Heuristics 5
-
PDF link points directly to executable/archive payload critical PDF_DIRECT_PAYLOAD_LINKPDF contains a clickable HTTP(S) URI whose path ends in an executable, script, shortcut, disk image, or archive extension. Documents can legitimately link to installers, so this is a high-risk delivery indicator rather than a standalone exploit fingerprint.
-
Image/button lure links to file-hosting download high PDF_FILE_HOSTING_DOWNLOAD_LUREPDF is an image-only or near-image-only lure with a clickable action to a public file-hosting download endpoint. This is a common malware delivery pattern: the visible page is just a screenshot/button, while the real payload is fetched from the external hosting service.
-
Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LUREPDF has 2 image(s), only 1 text block(s), carries a click-outward action, and is only 131 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
-
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGEOne or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://transfer.sh/get/GtL2jp/Adobe_Acrobat_DC_sib.msi In extracted file (objstm_0001_00.bin)
- https://ifrype.com/stats/click.php?key=from_login_iep&url=https://transaction-panel.click/app/In extracted file (objstm_0001_00.bin)
🗂 Part of campaign:
ifrype.com
6 samples
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
objstm_0001_00.bin |
pdf-objstm-decoded | PDF /ObjStm 1 0 obj (inflated) | 24392 bytes |
SHA-256: f896661e04813fb91e2acdc9ef678cd35d9db7db7245ee009be4ca55028dc28a |
|||
|
Detection
ClamAV:
No threats found
Obfuscation or payload:
likely
Carved artifact contains 1 long base64-like blob(s).
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.