PDF malware analysis — malicious · ede0cc3f0ab8fffd

MALICIOUS

PDF

35.9 KB Authoring application: PDF Studio

MD5: 46494e85207522ed9d7d053c61cd7a15 SHA-1: 2a0e81bf3b2f8d1ca71f32306d90c5b3ede4599a SHA-256: ede0cc3f0ab8fffd39101a5f5f976c50d40e7d329547bf0297c57b230975b414

62 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

The file is a PDF document identified by ClamAV as 'Pdf.Phishing.TtraffRobotInstall-7605656-0'. It contains multiple embedded URLs, one of which is also flagged as an external URI. These URLs likely lead to further malicious content or phishing pages, indicating a phishing or social engineering attack. No scripts were extracted from this sample.

Heuristics 3

ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://altasanacion.net/uploads/1/3/0/2/130271142/9821433.pdf
- http://galicia4g.com/uploads/1/3/0/5/130538996/mumisotu.pdf
- http://moulinsdecharlie.com/uploads/1/3/0/6/130640119/moxowar.pdf
- http://pineapplecoffeeandtea.com/uploads/1/3/0/3/130312964/bufilexoregomu-kazudenu-jituzagewotupip.pdf
- http://rickformichigan.net/uploads/1/3/0/4/130483271/5e7d1080.pdf
- http://neokundalini.org/uploads/1/3/0/7/130740438/130740438.html#age+of+empires+3+custom+maps+download

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000010b8.bin` `760d22932f176f91984271c06e7de71b350e8214002653ea1a4b754ac18b5c11`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x10B8	9016 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.