PDF malware analysis — malicious · eee543a1318411cb

MALICIOUS

PDF

32.8 KB Authoring application: PDFBox

MD5: ec5397d1dbadc676445ddeffe5a7f771 SHA-1: 851972041d1200c49d8eace3f819a93810a156c6 SHA-256: eee543a1318411cbf21dd0c50fc5a7d28b52dd1133bc2d0b966a58e5781bcaf7

94 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1204.002 Malicious File

The ML classifier and ClamAV detection strongly indicate malicious intent. The document body contains multiple embedded URLs, suggesting a phishing or social engineering lure to download further malicious content. The presence of these URLs points to a delivery mechanism for secondary payloads.

Machine Learning

Nyx PDF Classifier malicious score 0.9998

Heuristics 3

ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://sherryerskine.com/uploads/1/3/0/5/130545627/54d3f5cadb.pdf
- http://burningfiddleproductions.org/uploads/1/3/0/6/130639258/e0eecf3.pdf
- http://upperhunterfreshmeals.com.au/uploads/1/3/0/5/130546937/4f46e14.pdf
- http://chicagotoeflschool.com/uploads/1/3/0/2/130273733/f26898747.pdf
- http://tarifgo.de/uploads/1/3/0/7/130740566/130740566.html#hamartome+verruqueux+pdf
- http://tarifgo.de/uploads/1/3/0/7/130740566/130740566.html#hamartom

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00001085.bin` `04c291d6d12e3abf22be44e3885d1f1261c0109d8aefe932c83732cfc4275baa`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1085	10036 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.