Malicious PDF — malware analysis report

Static analysis result for SHA-256 494878bd5f81d3fc…

MALICIOUS

PDF

153.7 KB Authoring application: OpenOffice.org
MD5: aa6da00ca4dc754cc7a940c45c92abcf SHA-1: cd5ce56ca7d1d89b7f3f81dce8fd6b6deb836cc2 SHA-256: 494878bd5f81d3fc2873585298ae3c735ddfa431a416a114b8d3651f5bc43cbe
92 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The file is a PDF containing multiple embedded URLs, identified by the PDF_URI heuristic. The ML classifier and ClamAV detection strongly indicate maliciousness, with ClamAV specifically identifying it as Pdf.Phishing.TtraffRobotInstall-7605656-0. The embedded URLs likely lead to further malicious content or phishing pages, suggesting a phishing or malware distribution campaign. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://springvalleyvillagearborist.com/uploads/1/3/0/5/130590478/diwavumomametefapapo.pdf
    • http://rockallyourrelationships.com/uploads/1/3/0/3/130313383/sejapojag-xejan.pdf
    • http://kesh-dev.com/uploads/2020/01/28/wopavesawamukogik.pdf
    • http://eastcoastdesigns.net/uploads/1/3/0/6/130605159/sedorawasolepu.pdf
    • https://wutesebeworaze.weebly.com/uploads/1/3/0/5/130589342/vagamajosojunu-nenabaroroko.pdf
    • http://bravogolfaviation.com/uploads/1/3/0/6/130621542/f7f10aa5.pdf
    • http://greenwaystars.com/uploads/2020/01/27/gafodomopegakum-lubiwetalivufe-kevolome.pdf
    • http://richlinehome.ru/uploads/2020/01/27/3dc9ba3fe408f06.pdf
    • http://mrdoughansen.weebly.com/uploads/1/3/0/4/130490915/3314918.pdf
    • http://alliancemarketingservices.com/uploads/1/3/0/2/130289623/wadokimakofop.pdf
    • https://ruwaxake.weebly.com/uploads/1/3/0/3/130379485/4dcad7c5c507.pdf
    • http://mypointofheu.weebly.com/uploads/1/3/0/3/130324340/gupidi_guvol_bomaf_kodil.pdf
    • http://rajaf.smt-hb.ru/uploads/2020/01/28/c06e831b5d.pdf
    • http://blueconomy.solutions/uploads/1/3/0/2/130289498/9120763.pdf
    • http://dovapelupu.shapewear-official.pro/uploads/2020/01/28/5275395.pdf
    • https://daviwamasazoluz.weebly.com/uploads/1/3/0/5/130538981/puzilogowis.pdf
    • http://liveslivedwithlaw.net/uploads/1/3/0/2/130289427/numifadopon_narowabapisuk.pdf
    • http://drashcraft.com/uploads/1/3/0/4/130476574/deroseka-lotivogamujivov-givuworakawapu-deruki.pdf
    • https://mejefuris.weebly.com/uploads/1/3/0/6/130605218/fosakisexerar_dojujawo.pdf
    • http://mindforyouth.com/uploads/1/3/0/6/130639199/8552998.pdf
    • http://nuobeijinghotel-chinese.devsite-1.com/uploads/1/3/0/2/130272603/130272603.html#mhw+ps4+pro

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off00008b6d.bin
ff1f1742230e38c6de757745c32842f5ab6d1cfe2945748631b2c6e63e5e45d2		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x8B6D 148588 bytes
font_00_sfnt_off00001729.bin
4242195bb9680a0c0f2ba209518e3d0c0054caf692cc987128a584c17e6ed2bf		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1729 6904 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.