Malicious PDF — malware analysis report

Static analysis result for SHA-256 2c3f3adc6875c093…

MALICIOUS

PDF

39.1 KB Authoring application: pstoedit
MD5: 3ec08fc8b8a7ff0e1fe260af5e05f7e3 SHA-1: b955f8d0dce46ad965d98c78abdd85e6dc6b07e0 SHA-256: 2c3f3adc6875c093db28c6dfd15aed083d5a557f76217baabe47b67c859627f0
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The file is a PDF document that contains embedded URLs pointing to other PDF files. The ClamAV heuristic 'Pdf.Phishing.TtraffRobotInstall-7605656-0' strongly suggests a phishing campaign. The document body, though partially corrupted, includes text related to stoicism and the embedded URLs, indicating a lure to download further malicious content.

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://directordean.org/uploads/1/3/0/6/130604524/6267938.pdf
    • http://nationwidehealthgroup.com/uploads/1/3/0/5/130544734/a65a927e9d.pdf
    • http://shannanstanciuforschoolboard.com/uploads/1/3/0/6/130639859/065955a956c9f8d.pdf
    • http://commstech-hub.eisf.eu/uploads/1/3/0/2/130287246/fogar.pdf
    • http://somersetfoodtrail.org/uploads/1/3/0/3/130379299/130379299.html#a+guide+to+the+good+life+the+ancient+art+of+stoic

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000010e3.bin
047ba113090e3beb642b07560853325b1a4c2fb12073692ff02527c83ea3057f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10E3 9620 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.