MALICIOUS
124
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious File
The PDF file presents itself as an Adobe Acrobat update, but analysis reveals it contains a direct link to an executable payload disguised as a legitimate installer. This lure is designed to trick users into downloading and running the malicious MSI file, likely leading to further compromise.
Machine Learning
- Nyx PDF Classifier clean score 0.0003
Heuristics 5
-
PDF link points directly to executable/archive payload critical PDF_DIRECT_PAYLOAD_LINKPDF contains a clickable HTTP(S) URI whose path ends in an executable, script, shortcut, disk image, or archive extension. Documents can legitimately link to installers, so this is a high-risk delivery indicator rather than a standalone exploit fingerprint.
-
Image/button lure links to file-hosting download high PDF_FILE_HOSTING_DOWNLOAD_LUREPDF is an image-only or near-image-only lure with a clickable action to a public file-hosting download endpoint. This is a common malware delivery pattern: the visible page is just a screenshot/button, while the real payload is fetched from the external hosting service.
-
Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LUREPDF has 2 image(s), only 1 text block(s), carries a click-outward action, and is only 131 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
-
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGEOne or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://transfer.sh/get/GtL2jp/Adobe_Acrobat_DC_sib.msi In extracted file (objstm_0001_00.bin)
- https://waplog.com/msg/compose/211994947?return_url=https://transaction-panel.click/app/In extracted file (objstm_0001_00.bin)
🗂 Part of campaign:
ifrype.com
6 samples
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
objstm_0001_00.bin |
pdf-objstm-decoded | PDF /ObjStm 1 0 obj (inflated) | 24386 bytes |
SHA-256: c9ca3ca7453f1d77b32f5bc6465c7a3326db24b9c526d12a6c8749c69294fd1d |
|||
|
Detection
ClamAV:
No threats found
Obfuscation or payload:
likely
Carved artifact contains 1 long base64-like blob(s).
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.