PDF malware analysis — malicious · e924c0fd7e6c2183

MALICIOUS

PDF

999.0 KB Created: 2010-03-29 13:51:23 Authoring application: Microsoft Word - CV RHA.doc (via ScanSoft PDF Create! 2)

MD5: e2b2523cb772322d8d831a9dc4e101c1 SHA-1: 4b9dad7921bb2e3872abc5e4fefc52b4bf878430 SHA-256: e924c0fd7e6c21836591863f989183e3d4d954def5f870d552a2bc9528342be7

60 Risk Score

Malware Insights

MITRE ATT&CK

T1204.002 Malicious File

The ClamAV heuristic 'Pdf.Exploit.Agent-20365' strongly indicates that this PDF file contains an exploit. While no document body text or scripts were extracted for further analysis, the presence of an embedded URL to 'www.primopdf.com' suggests a potential delivery vector or lure. The file's metadata indicates it was created by Microsoft Word via PDF Create!, which is a common method for generating documents that may contain exploits.

Machine Learning

Nyx PDF Classifier clean score 0.0081

Heuristics 2

ClamAV: Pdf.Exploit.Agent-20365 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Exploit.Agent-20365
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://www.primopdf.com/
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/mm/

Extracted artifacts 18

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000040b4.bin` `d5dd07921386df34117eb8e30932dfaee804b3a94c46ebc20f32d43c0ff74551`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x40B4	21292 bytes
`font_01_sfnt_off00006338.bin` `614d62814afd39eb7ef766841847466e60e7947a1f263438ab06780b4a0f0fa3`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6338	19780 bytes
`font_02_sfnt_off0007900b.bin` `2d3c162b63d0d6038dea77362e8e1a39bc28332ad411d761364a3acb9df558c2`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7900B	5336 bytes
`font_03_sfnt_off00079ee8.bin` `2ee5df2c84ed8c90ae95220e39619d99185921f02f7df329b3c88f92219fe1e8`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x79EE8	16316 bytes
`font_05_sfnt_off0007dd9e.bin` `a170375ef410316a14ce9c6acff1608f50bc710c01ca86527db5fe5ab7209812`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7DD9E	3308 bytes
`font_06_sfnt_off0007e6cd.bin` `8875c53fb89c8f34439e920481b66e0a8d023a2528f8c2fa62d50243f324d72e`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7E6CD	18480 bytes
`font_07_sfnt_off00081d6a.bin` `8561d48d5bcc155cbd739372b4efb2058f52d66882c76f2f4abe8dbbec035d1b`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x81D6A	6440 bytes
`font_09_sfnt_off00083f73.bin` `2f956d98bfc91effd4382429ec8e6152d7cb1d7f8c03de38dc02b8c381c14793`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x83F73	18584 bytes
`font_10_sfnt_off000876b8.bin` `bc65f88ef446f38d6cc7c8f554202ac7f47cc25a713ccc18353384820f5cbf43`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x876B8	18276 bytes
`font_11_sfnt_off0008acd0.bin` `b8e1000ed32c236d5943b3a661a0e40550c70945119a16fee4e090aba7b34175`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x8ACD0	19468 bytes
`font_12_sfnt_off0008e6b8.bin` `457aebd0a9bb40fdeac2291ef2808d438313ef9aa5fde8d02043bd568ea08025`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x8E6B8	46880 bytes
`font_13_sfnt_off00097254.bin` `bd94436e19d64e0c7eedef7e750780913f74043f812d92a11f52f6ccd2da286b`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x97254	20572 bytes
`font_14_sfnt_off0009af79.bin` `7360f32d8cf252406040e2eee126e41ba0d8d2b5df65a64faf7ec2032a1dedb1`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x9AF79	20100 bytes
`font_15_sfnt_off0009eb07.bin` `67881285b610f1ef2cbc5dadafb7a00246dd042cc870abb58b0fd868eea7cf1d`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x9EB07	20928 bytes
`font_16_sfnt_off000a290a.bin` `7720a19c2e99937889673b63692d92c7226642ec0ffe3924bf26520905f18f91`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xA290A	5336 bytes
`font_17_sfnt_off000a37e9.bin` `b2ed51b5264591124803a0064de006d708dcf8bc5db1f1800ab3285ae1f8cea5`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xA37E9	20060 bytes
`font_18_sfnt_off000a73ac.bin` `a151be3731977e07d577dcd5b8540aa783e0c71e0ca93d14fd75af71bb18241e`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xA73AC	19464 bytes
`font_19_sfnt_off000ac9aa.bin` `ac89c0bcc61e2815b467cfb44ca1b547278181ddbe91c321f06404203c6ee309`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xAC9AA	35130 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.