PDF malware analysis — malicious · f036227b008033d8

MALICIOUS

PDF

30.6 KB Authoring application: LibreOffice Draw

MD5: 2a6c8923ceff5fbbbbb1170623678fd1 SHA-1: f505f869c3fb3fc0bf427a66601b0791810826b2 SHA-256: f036227b008033d83eaf4fedaa804144b3125a3562cabb7a6c390640d53e173b

94 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell

The file is a PDF document that contains multiple external URLs. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the ML classifier strongly indicate malicious intent, likely phishing or malware distribution. The embedded URLs suggest the document is designed to redirect the user to download further malicious content.

Machine Learning

Nyx PDF Classifier malicious score 0.9998

Heuristics 3

ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://beers.sg/uploads/1/3/0/5/130589163/1064d4723d23809.pdf
- http://goldsmitsydnor.com/uploads/1/3/0/3/130324416/1829279.pdf
- http://somemecosmetics.com/uploads/1/3/0/6/130604441/3936823.pdf
- http://taideinto.com/uploads/1/3/0/4/130488583/1498629.pdf
- http://365poolspa.com/uploads/1/3/0/6/130604351/1108079.pdf
- http://feijoasarefabulous.com/uploads/1/3/0/6/130621582/130621582.html#metodo+suzuki+para+flauta+dulce+pdf

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00001052.bin` `de17d948bc7f4c400c385a9e8e689806b0ed38a4c9ec9f1112da7368ed871368`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1052	8996 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.