Malicious PDF — malware analysis report

Static analysis result for SHA-256 4c606652c3e4211d…

MALICIOUS

PDF

58.0 KB Authoring application: Serif PagePlus
MD5: 2caa037a091798f0a422308470209fcd SHA-1: 25357d2c2c6836fa5a04ca0b9f8aacf6e813fc8d SHA-256: 4c606652c3e4211d419f9491b4bd2e3f2b7a545b499bd0be2eb4eae467c2006d
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment

The file is a PDF document that contains embedded URLs pointing to other PDF files, suggesting a phishing or malware distribution campaign. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the ML classifier strongly indicate malicious intent. The document body, though partially corrupted, mentions 'New discoveries in biotechnology 2018 pdf', likely a lure to entice users to click on the embedded malicious links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ilpiattorestaurant.net/uploads/1/3/0/5/130588433/4b0cc43b65b497.pdf
    • http://bubbcomics.com/uploads/1/3/0/6/130605405/digakugixitizi_fozuvuvolizezu_datagubuwuza_duguvedaju.pdf
    • http://betdouble.ru/uploads/2020/01/29/lofomusepumu.pdf
    • http://nbptwedding.com/uploads/1/3/0/4/130476427/kewozirovudemog.pdf
    • http://danlynnwatt.com/uploads/1/3/0/3/130379549/2199334.pdf
    • http://afaparents.org/uploads/1/3/0/2/130289789/130289789.html#new+discoveries+in+biotechnology+2018+pdf

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001130.bin
f33039790296483993c763a2ff41a3575a1a0284a2b3b4ab2424b2d69b373cc4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1130 8928 bytes
font_01_sfnt_off0000938d.bin
6a2cda8a88f9832d8a5d335ec3acfe3d937a44a573845a5f2697a3c45fcadc2d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x938D 16120 bytes
font_02_sfnt_off0000a824.bin
a98ea1ab65533aa5a8d930a9ecda3240c4afa5cda94bda55fcb893fdfae47903		 pdf-font-stream PDF embedded font (sfnt) at offset 0xA824 2892 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.