Malicious PDF — malware analysis report

Static analysis result for SHA-256 2db7ce7ed0986132…

MALICIOUS

PDF

44.8 KB Authoring application: LibreOffice Draw
MD5: 4cbe71ac6b0aa8b312977adb2997cf69 SHA-1: 2f05536bf63a15034a2a85ed65d09d662c306323 SHA-256: 2db7ce7ed098613257c04344dce0d36851bf7ae9e34b3954cf5b63447e71f481
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The file is a PDF document that contains embedded URLs pointing to other PDF files. The document body, though partially corrupted, suggests a lure related to 'Pt exercises for knee injury'. The ClamAV detection and the presence of external URIs strongly indicate a phishing or malware distribution attempt. The primary attack vector appears to be tricking the user into downloading a malicious PDF disguised as helpful content.

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://northstarmuseum.org/uploads/1/3/0/5/130589393/feab5e920.pdf
    • http://nshs.northsmithfieldschools.com/uploads/1/3/0/2/130274256/punorufejulisa-vepidagawi.pdf
    • http://rawk-cbd.net/uploads/1/3/0/2/130289421/fekopopizimag-dijeraniporib.pdf
    • http://reboundat.com/uploads/1/3/0/7/130738720/130738720.html#pt+exercises+for+knee+injury

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00000fdf.bin
7c2fdc6c986b96a8febc35f0b2926f691ec1d84c6a03be956f8febfe961b125f		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFDF 8076 bytes
font_01_sfnt_off000069cb.bin
779aa567746046747dac965df7fdfb06ff632674a0a99ce247a327bf89f0fa63		 pdf-font-stream PDF embedded font (sfnt) at offset 0x69CB 16036 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.