Malicious PDF — malware analysis report

Static analysis result for SHA-256 3344f856d4b5afca…

MALICIOUS

PDF

157.1 KB Authoring application: OpenOffice.org
MD5: 75e54868d66d3947c6cc6d1483224c40 SHA-1: 43094edc2975cb29ce7476396cf41b06d9911cfe SHA-256: 3344f856d4b5afcaf31a646432c4dc3edb22e29b306e3dbd69fd01eed6e2182e
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment

The file is identified as malicious by ClamAV with the signature Pdf.Phishing.TtraffRobotInstall-7605656-0. It contains multiple embedded URLs that point to PDF files hosted on various domains, suggesting a phishing or social engineering lure. The document body, though partially corrupted, contains references to 'Hp 48sx manual', indicating a pretext to trick users into downloading the linked malicious content.

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://midtownatlantachiropractor.net/uploads/1/3/0/5/130542734/4880002.pdf
    • http://alaskasummerinstitute2020.com/uploads/1/3/0/6/130639355/zovoxebalipo.pdf
    • http://emilyburdettphotography.com/uploads/1/3/0/5/130551033/zesusuzarabegis.pdf
    • http://beingself-centered.com/uploads/1/3/0/5/130550930/130550930.html#hp+48sx+manual

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001136.bin
f051f9e4f09d7a7be12c2991993c3dc7da5c93d9e3042cff782fecb0c96bf8a2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1136 9392 bytes
font_01_sfnt_off00013518.bin
46b85ea7cd590d15fee740d270f1e6d20e474cd57ed05bca5f10d2086f37386f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13518 17828 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.