PDF malware analysis — malicious · f5feb6e269aca1a9

MALICIOUS

PDF

30.1 KB Authoring application: PDFedit

MD5: 254401a38584831adadd9434184dca48 SHA-1: 8c062b30c410dbf4ed8b6fcab40d0e92ecfb6902 SHA-256: f5feb6e269aca1a99d80dfa8eddc09915eb3a0b9400b5651fe0604c8ca5590de

94 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment

The PDF contains multiple embedded URLs, one of which is directly referenced in the document body, suggesting a phishing or social engineering lure. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a phishing attack pattern. The document body's content about 'Pure substances and mixtures worksheet answers' is likely a pretext to encourage download and interaction with the embedded malicious links.

Machine Learning

Nyx PDF Classifier malicious score 0.9994

Heuristics 3

ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://baitpro.us/uploads/1/3/0/6/130620470/2863700.pdf
- http://rootfivefarm.com/uploads/1/3/0/5/130539182/tuwedunudojaw_bifinojiju_wakupeku.pdf
- http://shawsautodetail.com/uploads/1/3/0/7/130739648/66023a.pdf
- http://cecilyeiferle.com/uploads/1/3/0/5/130539659/130539659.html#pure+substances+and+mixtures+worksheet+answers

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00000f7c.bin` `f5dcb9c415cb235409d4c04bae81abd7e89887f555d4c02c5f329417b12224b4`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF7C	7340 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.