Malicious PDF — malware analysis report

Static analysis result for SHA-256 1e5462b94f9b8676…

MALICIOUS

PDF

55.5 KB Authoring application: Pdftk First seen: 2020-09-24
MD5: 72d4c63066d522799d94ac522e7581ce SHA-1: 62c7d6f7fb5c851fffb8f2a3dbe69cd37a4f436e SHA-256: 1e5462b94f9b867631c40a98221d54b9ced0d8537b94f4a7eb1942b159023771
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ML classifiers and ClamAV, specifically flagged as a phishing attempt. It contains multiple embedded URLs that likely lead to further malicious content or downloads. The document body, though truncated and obfuscated, references the 'FIBA u18 asia championship 2019', suggesting a lure to entice users to click on the embedded malicious links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://asiamarketcorp.com/uploads/1/3/0/3/130313161/vunomapuwo-kemukokudebir.pdf PDF link annotation
    • http://nickmilne.com/uploads/1/3/0/6/130603948/9172d.pdfIn PDF document text
    • http://roilights.com/uploads/1/3/0/2/130271108/37bf40a4e.pdfIn PDF document text
    • http://candacegraham.com/uploads/1/3/0/5/130545447/15c3efdbb.pdfIn PDF document text
    • http://misssupremepurityqueen.com/uploads/1/3/0/6/130639026/130639026.html#fiba+u18+asia+championship+2019In PDF document text
🗂 Part of campaign: shared payload 362efc88ee 4 samples

Related samples 3

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000123b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x123B 10480 bytes
SHA-256: 6330cd7c7c71f1099b34100a10de7541cc9cc22b9f70648de8bcecb862e57c71
font_01_sfnt_off00009ee1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x9EE1 2024 bytes
SHA-256: 362efc88ee3e386859df28ac84511f1a9117469b97f067cf82e04b47197d905a

Open this report in the interactive analyzer, or submit your own file for analysis.