Malicious PDF — malware analysis report

Static analysis result for SHA-256 2d88737837db0699…

MALICIOUS

PDF

49.7 KB Authoring application: Solid Converter PDF
MD5: 6d62f9d1e7bd02d42479998fc3ed06ea SHA-1: dc85860dc4e79547de6ffbbc57e8bc58c28ab2fb SHA-256: 2d88737837db06998136e0343bfb03de2f0d3412208423bc42e3b52eb436ab15
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The ClamAV heuristic 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the presence of multiple embedded URLs strongly suggest a phishing campaign. The document body, though heavily obfuscated, contains references to URLs that likely serve as lures for malicious content. No scripts were extracted from this sample.

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://trinityjamestown.net/uploads/1/3/0/7/130739351/938e83bbc2.pdf
    • http://beeldschermverhuur.nl/uploads/1/3/0/4/130477979/rovupowitus.pdf
    • http://keynoteconnections.com/uploads/1/3/0/4/130477915/gopusogelatazo.pdf
    • http://mindforyou.org/uploads/1/3/0/2/130289700/130289700.html#sphere+surface+area+and+volume+worksheet

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000100b.bin
3d2d97e76227fccd8fb614cf709b8ba1b255db1308174883816dc56c04a6fb60		 pdf-font-stream PDF embedded font (sfnt) at offset 0x100B 8768 bytes
font_01_sfnt_off00006e98.bin
8008a32577a136484752617bc9ff17db714dcf6fe993e6858996a4337422b96a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6E98 9476 bytes
font_02_sfnt_off000087ad.bin
985cbd9ba5b629f1b749d04d852c0eecb5d8ad374186a1044a60da9476420dc6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x87AD 2788 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.