PDF malware analysis — malicious · db3ac53d6d7af36b

MALICIOUS

PDF

MD5: 60f228439ac915353c10f57124260adc SHA-1: 00cbdae2a6afe4a2fc65e9df5fd04efea08eabf3 SHA-256: db3ac53d6d7af36b256e11b5a96e951424ac10cf539e35a71ac573d8f69c54de

60 Risk Score

Malware Insights

MITRE ATT&CK

T1204.002 Malicious File

The PDF file contains a direct link to a ZIP archive hosted on softsols.net. This is a common technique for delivering malware, where the user is enticed to click the link and download a malicious payload. The heuristic firing 'PDF_DIRECT_PAYLOAD_LINK' strongly supports this attack pattern. No scripts were extracted, and the document body did not provide further context beyond the URL.

Machine Learning

Nyx PDF Classifier clean score 0.0422

Heuristics 2

PDF link points directly to executable/archive payload critical PDF_DIRECT_PAYLOAD_LINK

PDF contains a clickable HTTP(S) URI whose path ends in an executable, script, shortcut, disk image, or archive extension. Documents can legitimately link to installers, so this is a high-risk delivery indicator rather than a standalone exploit fingerprint.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://softsols.net/kbase/64521b0224d69.zip

Extracted artifacts 5

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_cff_off00000703.bin` `321e7c1033e1f2d21a39e55764be64c5b600a25ef08997d0815b6c94fe4f25cf`	pdf-font-stream	PDF embedded font (cff) at offset 0x703	2587 bytes
`font_01_cff_off00002c2d.bin` `edb617c123f49533789229e253b0ed4b762c942ee8b361ae2a51c5de64c039f5`	pdf-font-stream	PDF embedded font (cff) at offset 0x2C2D	539 bytes
`font_02_cff_off0000495c.bin` `ad94c8d0782a8d4ff4712e2208c4cd4a24e4055c5ba482e5ef060cdc240d7d50`	pdf-font-stream	PDF embedded font (cff) at offset 0x495C	3497 bytes
`font_03_cff_off00007216.bin` `7aba96ca5b702ebea26fcfaab297fed56fcab65245720eb40758c8ee684af466`	pdf-font-stream	PDF embedded font (cff) at offset 0x7216	633 bytes
`font_04_cff_off00008fb5.bin` `b0f74c1d3f8de6411025fe4536ea7097b9f7300348af5ef4c63b64681bbab0e5`	pdf-font-stream	PDF embedded font (cff) at offset 0x8FB5	1340 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.