Malicious PDF — malware analysis report

Static analysis result for SHA-256 3712cbba57274529…

MALICIOUS

PDF

48.0 KB Authoring application: Soda PDF First seen: 2020-09-24
MD5: 6c5fce72d0f4ca923b5e2d1182d8a9c1 SHA-1: a077a5baebf78b288fed478caa75ef0e608bdd5c SHA-256: 3712cbba572745294e2113c9fba066319e45645d2eeeb6994f67f5ad57adab85
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF that contains multiple embedded URLs pointing to potentially malicious content. The ClamAV detection and ML classifier strongly indicate malicious intent, likely related to phishing or malware distribution. The document body, though heavily obfuscated, contains references to URLs that are likely part of a lure to download further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://samrichardson.org/uploads/1/3/0/5/130539235/wumusuxeverakut-borajula-sunuxufewemixo-gewokamibago.pdf PDF link annotation
    • http://rose-from-concrete.com/uploads/1/3/0/5/130538836/cbae494c6a7cb28.pdfIn PDF document text
    • http://miriamswritingportfolio.weebly.com/uploads/1/3/0/5/130588595/3efb96d8cd9.pdfIn PDF document text
    • http://davidmarquesibanez.com/uploads/1/3/0/5/130588527/130588527.html#p0344+camshaft+position+sensor+performanceIn PDF document text
    • http://dejavu.sourceforge.netIn extracted file (font_01_sfnt_off000070bf.bin)
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (font_01_sfnt_off000070bf.bin)

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001061.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1061 8472 bytes
SHA-256: bd48648e55a3bc15d2759bad79745e1abc300070c624a23848805a6997d39c6f
font_01_sfnt_off000070bf.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x70BF 17648 bytes
SHA-256: 062abeeb0630068c9ebda4cd69880ba7d22c023ef851e82e77d1a768bfa0705b

Open this report in the interactive analyzer, or submit your own file for analysis.