Malicious PDF — malware analysis report

Static analysis result for SHA-256 2e8a5c181dcac6e7…

MALICIOUS

PDF

41.9 KB Authoring application: LibreOffice Draw
MD5: 9f755cbe1f6ff1c75839f25caae753d5 SHA-1: 237d8cc70ab1334355d955f2b5a390295d29fd14 SHA-256: 2e8a5c181dcac6e7b985940849111d70a911c6be5d55d66c4950473dc4db6445
102 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The file is a PDF document detected by ClamAV as Pdf.Phishing.TtraffRobotInstall-7605656-0. The document body contains text related to 'NSDL new pan card application status' and includes multiple embedded URLs pointing to PDF and HTML files hosted on various domains. The heuristic 'SE_MFA_LURE' indicates the document is designed to harvest credentials or abuse multi-factor authentication, consistent with phishing attacks.

Heuristics 4

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • MFA / one-time-code harvesting lure high SE_MFA_LURE
    Document asks for a one-time code, authenticator approval, or MFA confirmation — consistent with credential phishing kits that steal session tokens or abuse multi-factor authentication
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://amyeschlimanteachingportfolio.com/uploads/1/3/0/5/130541028/tozaluzapadonaleje.pdf
    • http://saintjohnsmilton.org/uploads/1/3/0/6/130621035/586408.pdf
    • http://azzaziphoto.com/uploads/1/3/0/5/130550931/c4c06f4107718.pdf
    • http://zawuxapil.ww7ww.top/uploads/2020/01/29/2f10e71e3ef.pdf
    • http://aascapedesign.com/uploads/1/3/0/2/130289173/jarimorepefum_kadozixobix.pdf
    • http://beingself-centered.com/uploads/1/3/0/6/130603764/130603764.html#nsdl+new+pan+card+application+status

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000010ef.bin
bf2931247d1c347b0143b313832fc6e76c5cba731e3f1a14a62786624271259e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10EF 8388 bytes
font_01_sfnt_off00005d40.bin
32b54217619f9438721b423dc2f4f4da0f78781b0811ea49af2be6b0310ecf56		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5D40 16164 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.