Malicious PDF — malware analysis report

Static analysis result for SHA-256 38dfbd742f0fe03c…

MALICIOUS

PDF

225.5 KB Authoring application: OpenOffice Draw
MD5: 007faed7797ec215c7974c59040daada SHA-1: b3d962ed758ce74d99036735f34e56471f5be297 SHA-256: 38dfbd742f0fe03c680fce66148e79d12781f0550f9a146402addd243dcd75cd
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment

The file is a PDF document identified by ClamAV as 'Pdf.Phishing.TtraffRobotInstall-7605656-0'. It contains multiple embedded URLs, one of which is directly referenced in the PDF metadata. The document body, though heavily obfuscated, suggests a lure related to 'Bangladesh airport information' to entice users to click on the embedded links, likely leading to further malicious content.

Machine Learning

  • Nyx PDF Classifier suspicious score 0.3834

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://sovopigawerewip.weebly.com/uploads/1/3/0/3/130313088/89ab29a1616.pdf
    • http://radiusmedgroup.com/uploads/1/3/0/2/130270931/dajumini.pdf
    • http://famumela.rcliffapp.com/uploads/2020/01/27/furusotukivixefot.pdf
    • http://theelfbox.com/uploads/1/3/0/6/130639965/130639965.html#bangladesh+airport+information

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001311.bin
17c4c1858db2849bf7adff67ea5a9f5342f94df356793f4396dd2b448ae23761		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1311 11232 bytes
font_01_sfnt_off0000a3c4.bin
ceac17bedaab402baa548dac8b20b2b61dbf52418c8a7fe477b6c25721ce9b11		 pdf-font-stream PDF embedded font (sfnt) at offset 0xA3C4 2732 bytes
font_02_sfnt_off0000ae28.bin
7dc8cab7dd33fcc309a8e63dee52a5682d1d81bb9b36b1ef11af5d6cab4bd44d		 pdf-font-stream PDF embedded font (sfnt) at offset 0xAE28 11684 bytes
font_03_sfnt_off0000ce2e.bin
c9f06c38c733de89869aa24372049b8229f562476f7e8f73b7014be8c2cf2d30		 pdf-font-stream PDF embedded font (sfnt) at offset 0xCE2E 16556 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.