Malicious PDF — malware analysis report

Static analysis result for SHA-256 077e4263d3497aa5…

MALICIOUS

PDF

62.5 KB Authoring application: Poppler-utils
MD5: 5d5fc4d99c471553e593fe3f525a063d SHA-1: 1e10b4b35c495da1a592020f361f30b4d409575c SHA-256: 077e4263d3497aa51adc9f8f726f2a402e0ed8e1553276efa888cbfee3ed8339
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as malicious by ML classifiers and ClamAV, specifically identified as 'Pdf.Phishing.TtraffRobotInstall-7605656-0'. The document body contains embedded URLs that likely serve as lures for users to download further malicious content. The presence of multiple unknown reputation URLs suggests a phishing or credential harvesting attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9965

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://afcyberworx.us/uploads/1/3/0/3/130324289/c3e2cb51.pdf
    • http://g3models.com/uploads/1/3/0/2/130289380/jugogag_sobimovul_vebezumijala.pdf
    • http://lovefoundationproject.com/uploads/1/3/0/4/130436152/nojekeri.pdf
    • http://myentouragemusic.com/uploads/1/3/0/3/130379430/130379430.html#bring+me+to+life+drum+pdf
    • http://linux.thai.net/projects/fonts-tlwg
    • http://www.thaitux.info
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License
    • http://www.adobe.com/).Noto
    • http://www.google.com/get/noto/http://www.adobe.com/type/This
    • http://scripts.sil.org/OFLNoto

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000105c.bin
4c47cfeff0a42f7192bc7221f06e0d53df940e1fb11d2dc01a9f138572fcbccb		 pdf-font-stream PDF embedded font (sfnt) at offset 0x105C 9024 bytes
font_01_sfnt_off00007aad.bin
2f4bd1a23568a3bb4cc57684d771003c26c3c80dcb9788a7d9bd1e100b67832b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7AAD 18608 bytes
font_02_sfnt_off0000973c.bin
003c70c02e0fc72dd381dce84c28c32ed759ca6719f77917968ddff18fe03f93		 pdf-font-stream PDF embedded font (sfnt) at offset 0x973C 6316 bytes
font_03_sfnt_off0000ab26.bin
e2ccef06c63a6eeabdf4a4426e0ab4b82967e25df8688b43999bde431939ff4a		 pdf-font-stream PDF embedded font (sfnt) at offset 0xAB26 11164 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.