Malicious PDF — malware analysis report

Static analysis result for SHA-256 109b99cf142350a7…

MALICIOUS

PDF

36.2 KB Authoring application: Poppler-utils
MD5: 2c933b58e684c3d657b19067677e969f SHA-1: 6e29321fb8d5f80d014e330f05f8058b75413dfd SHA-256: 109b99cf142350a72456e8d06463fc091c23770949faaa90f2488324a4aca7e7
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by multiple engines, including ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The document body, despite being heavily obfuscated, contains references to 'DNA' and 'Poppler-utils', potentially serving as a lure. The presence of multiple external URLs, particularly 'http://agm35.icu/uploads/2020/01/28/jiwezuzuwokas.pdf', suggests the document is designed to redirect users to malicious content, likely a phishing page or further malware download. The PDF_URI heuristic further confirms the external URL. Although no scripts were explicitly extracted, the nature of the PDF and the embedded URLs strongly suggest a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://agm35.icu/uploads/2020/01/28/jiwezuzuwokas.pdf
    • https://vezavanavelu.weebly.com/uploads/1/3/0/5/130551518/f737fae8f7221df.pdf
    • http://douglasmsbands.weebly.com/uploads/1/3/0/6/130639779/dinugab.pdf
    • http://uniquelysatarus.com/uploads/1/3/0/5/130588687/819b2bc28a8d9d.pdf
    • http://newperspectivemedical.com/uploads/1/3/0/4/130436202/130436202.html#a+vs+b+form+dna
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00000fbc.bin
ce9336809b406c60795a5479d8349d548fce0d127c6958493bc1785fb69d329b		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFBC 7756 bytes
font_01_sfnt_off0000468a.bin
f689831a78fdc75a09928fee1cdc91396d006636b118bdc9cd58e9fd6488ec20		 pdf-font-stream PDF embedded font (sfnt) at offset 0x468A 16136 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.