Malicious PDF — malware analysis report

Static analysis result for SHA-256 2990ae1b42e63358…

MALICIOUS

PDF

36.1 KB Authoring application: LibreOffice Draw First seen: 2020-09-24
MD5: 3fd993e4d0514ffdc734c140b6241ea2 SHA-1: e9ae47cdf41c86ed8245808ec23d217f75376b3e SHA-256: 2990ae1b42e63358534104615f9a073354919f00673676ed438ed2dc5a671772
102 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains multiple embedded URLs that likely lead to malicious content, as indicated by the ClamAV detection and ML classifier. The document body, though obfuscated, contains references to these URLs and presents itself as an agenda or font download, suggesting a phishing or social engineering lure. The presence of external URIs and the overall detection pattern point towards a phishing campaign.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://beclaims.com/uploads/1/3/0/4/130476266/8c84f9084.pdf PDF link annotation
    • http://mrsuttonhistory.com/uploads/1/3/0/4/130476183/lofeg.pdfIn PDF document text
    • http://ninjamindfulness.com/uploads/1/3/0/6/130605077/ferofekokanabobe.pdfIn PDF document text
    • http://lesetoiles-paris.com/uploads/1/3/0/5/130588546/857856.pdfIn PDF document text
    • http://misbailes.com/uploads/1/3/0/5/130539718/130539718.html#agenda+bold+italic+font+freeIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Related samples 7

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00000fb9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFB9 8228 bytes
SHA-256: 3b8049f3a12315b12a76375ee9e6ca72f3c3c9d123efa2867ade9154f83dd0b9
font_01_sfnt_off00004698.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x4698 16084 bytes
SHA-256: d65752e558a9090157c9a1b02647c04d2680198cf9d52ff42939ef8ccbf7fabd

Open this report in the interactive analyzer, or submit your own file for analysis.