Malicious PDF — malware analysis report

Static analysis result for SHA-256 0b2a0b47893a0194…

MALICIOUS

PDF

47.9 KB Authoring application: OpenOffice Draw
MD5: 78b4544ec1b027f0e9258bb0d1063290 SHA-1: 156ca5aa9115531572c3a4e665ea6a60700d7a93 SHA-256: 0b2a0b47893a0194f978240cff2552dbf9fc1629529fc2692dd9f13df36e432c
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document that contains embedded URLs pointing to other PDF files and an HTML page. The document body mentions 'Online atm card apply union bank of india', suggesting a phishing lure related to banking. The presence of multiple suspicious URLs and a high ML classifier score indicate malicious intent, likely to redirect users to fraudulent content or download further malware.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://preschoolhouse.com/uploads/1/3/0/6/130605273/lixijuruxobal-xovobavosudi.pdf
    • http://kineticchiropracticstudio.com/uploads/1/3/0/2/130273573/18006ac.pdf
    • http://mizfamphoto.com/uploads/1/3/0/5/130539311/5be535c.pdf
    • http://nomadic-chris.com/uploads/1/3/0/3/130323767/4559771.pdf
    • http://arcadiagardensllclandscapinganddesign.com/uploads/1/3/0/5/130539492/130539492.html#online+atm+card+apply+union+bank+of+india
    • https://savannah.gnu.org/projects/freefont/
    • http://www.gnu.org/licenses/
    • http://www.gnu.org/copyleft/gpl.html
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001043.bin
a672f924fc15b55cfe9a01a092cf984076cb31ce2f9e97a96d763d3219f3bf8a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1043 8804 bytes
font_01_sfnt_off00005bc3.bin
266b4a103725b50a5879f37fbd3262b3008951c01f0d0dca8372c743ae301a69		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5BC3 9584 bytes
font_02_sfnt_off000074c3.bin
32b54217619f9438721b423dc2f4f4da0f78781b0811ea49af2be6b0310ecf56		 pdf-font-stream PDF embedded font (sfnt) at offset 0x74C3 16164 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.