Malicious PDF — malware analysis report

Static analysis result for SHA-256 212bcc7b11f9ef31…

MALICIOUS

PDF

216.7 KB Authoring application: Pdftk First seen: 2020-09-24
MD5: c2cacbcce18b480a5ad4fba4ac21216e SHA-1: b9b8fc685a700116c67cace3c834e56276ff6239 SHA-256: 212bcc7b11f9ef31f94a6330300a83161636cc17b9dba946928ce315fad38ef5
114 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The file is identified as a PDF containing lures for advance-fee scams, specifically mentioning lottery winnings or parcel deliveries. It also exhibits characteristics of callback phishing, prompting users to call a number for support or to resolve issues. The presence of numerous external URLs suggests a delivery mechanism for further malicious content or phishing pages. No scripts were extracted, limiting the analysis of direct execution behavior.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9085

Heuristics 4

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) or Microsoft license-boilerplate documents that carry no urgency or charge/dispute escalation.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://stillaraider99.com/uploads/1/3/0/5/130551423/pomag.pdf PDF link annotation
    • http://takeatriprentals.com/uploads/1/3/0/7/130740563/f4754.pdfIn PDF document text
    • http://androidisfor.me/uploads/1/3/0/4/130435581/zofogowexadulopunu.pdfIn PDF document text
    • http://nebraskasolarschools.net/uploads/1/3/0/5/130551656/97fa37b6648c931.pdfIn PDF document text
    • http://seniors1stfinancial.com/uploads/1/3/0/7/130740590/xolun.pdfIn PDF document text
    • http://www.cloud.sentinel-air.com/uploads/1/3/0/7/130739656/foxamipobeja-tivenibidovajin.pdfIn PDF document text
    • http://entrepreneurialinnovations.com/uploads/1/3/0/8/130873941/fugeburexoge-nadezilozipak-rakemefozeru-gedive.pdfIn PDF document text
    • http://angelcleaningservice.net/uploads/1/3/0/2/130289237/fikapamejure.pdfIn PDF document text
    • http://beachhousedestin.net/uploads/1/3/0/8/130813609/1054618.pdfIn PDF document text
    • http://myafricanloveseries.com/uploads/1/3/0/3/130323675/befapifofop.pdfIn PDF document text
    • http://democracy.nyc/uploads/1/3/0/8/130874468/busuw.pdfIn PDF document text
    • http://worldclub888.net/uploads/1/3/0/5/130588393/8342535.pdfIn PDF document text
    • http://www.wecandefytheodds.com/uploads/1/3/0/4/130483650/juguwu_zasuju_rezetemoxulu.pdfIn PDF document text
    • http://samanthaandem.com/uploads/1/3/0/7/130739247/9764213.pdfIn PDF document text
    • http://collegeauditionsupport.com/uploads/1/3/0/7/130739164/vegonup.pdfIn PDF document text
    • http://justicecollaborativeatcornell.com/uploads/1/3/0/5/130589219/sivafe.pdfIn PDF document text
    • http://niffianva.com/uploads/1/3/0/7/130739387/mixujor.pdfIn PDF document text
    • http://mail.hemingwaycottage.com/uploads/1/3/0/4/130483869/4177481.pdfIn PDF document text
    • http://reneteassuredtitleagency.us/uploads/1/3/0/4/130477252/312ba410cc31.pdfIn PDF document text
    • http://medezen.net/uploads/1/3/0/2/130289369/8987158.pdfIn PDF document text
    • http://053748270.com/uploads/1/3/0/4/130435500/ad202047e5f507.pdfIn PDF document text
    • http://www.oaklandpoolcare.com/uploads/1/3/0/6/130639868/9beebd.pdfIn PDF document text
    • http://adsl-63-204-18-60.benefitplans.org/uploads/1/3/0/7/130776571/130776571.html#hsn+code+8483+gst+rateIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://fedoraproject.org/wiki/Licensing/LiberationFontLicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005b12.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5B12 9052 bytes
SHA-256: 0f0ece3b58a4919114ef55d1c8737c7bcff314bb2c42da2573515420364d1124
font_01_sfnt_off000191fe.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x191FE 2600 bytes
SHA-256: 41d5c9cb4d60b7530e3cfd93a78efd430fe179aa57a8296e74fb8a971da4b0ee

Open this report in the interactive analyzer, or submit your own file for analysis.