Malicious PDF — malware analysis report

Static analysis result for SHA-256 38dfbd742f0fe03c…

MALICIOUS

PDF

225.5 KB Authoring application: OpenOffice Draw First seen: 2020-09-24
MD5: 007faed7797ec215c7974c59040daada SHA-1: b3d962ed758ce74d99036735f34e56471f5be297 SHA-256: 38dfbd742f0fe03c680fce66148e79d12781f0550f9a146402addd243dcd75cd
64 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document that contains embedded URIs pointing to external resources. One of these URIs, https://sovopigawerewip.weebly.com/uploads/1/3/0/3/130313088/89ab29a1616.pdf, was flagged by ClamAV as Pdf.Phishing.TtraffRobotInstall-7605656-0. The presence of these external links suggests an attempt to direct the user to malicious content, likely for phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier suspicious score 0.3834

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://sovopigawerewip.weebly.com/uploads/1/3/0/3/130313088/89ab29a1616.pdf PDF link annotation
    • http://radiusmedgroup.com/uploads/1/3/0/2/130270931/dajumini.pdfIn PDF document text
    • http://famumela.rcliffapp.com/uploads/2020/01/27/furusotukivixefot.pdfIn PDF document text
    • http://theelfbox.com/uploads/1/3/0/6/130639965/130639965.html#bangladesh+airport+informationIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://fedoraproject.org/wiki/Licensing/LiberationFontLicenseIn PDF document text
    • https://savannah.gnu.org/projects/freefont/In PDF document text
    • http://www.gnu.org/licenses/In PDF document text
    • http://www.gnu.org/copyleft/gpl.htmlIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Related samples 1

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001311.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1311 11232 bytes
SHA-256: 17c4c1858db2849bf7adff67ea5a9f5342f94df356793f4396dd2b448ae23761
font_01_sfnt_off0000a3c4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xA3C4 2732 bytes
SHA-256: ceac17bedaab402baa548dac8b20b2b61dbf52418c8a7fe477b6c25721ce9b11
font_02_sfnt_off0000ae28.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xAE28 11684 bytes
SHA-256: 7dc8cab7dd33fcc309a8e63dee52a5682d1d81bb9b36b1ef11af5d6cab4bd44d
font_03_sfnt_off0000ce2e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xCE2E 16556 bytes
SHA-256: c9f06c38c733de89869aa24372049b8229f562476f7e8f73b7014be8c2cf2d30

Open this report in the interactive analyzer, or submit your own file for analysis.