Malicious PDF — malware analysis report

Static analysis result for SHA-256 4d9765113c8ff7ad…

MALICIOUS

PDF

31.6 KB Authoring application: Adobe PDF Library 9.0
MD5: 365e1169ff121468571fde75ebbd55bf SHA-1: 7b163b01bb312e9d0a19083782534859bbb8e48f SHA-256: 4d9765113c8ff7add9bf8564efe07934ff47d35d1d9696bcc931974c0de192bd
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The file is a PDF document that contains embedded URLs pointing to other PDF files and an HTML file. The document body text, while partially obfuscated, mentions downloading subtitles and includes these URLs, suggesting a lure to trick users into downloading further malicious content. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' strongly indicates a phishing or malicious redirection campaign.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://5foot1ninja.com/uploads/1/3/0/5/130590482/8093353.pdf
    • http://thebelieversoutlet.com/uploads/1/3/0/6/130620877/suruj-zejexi-nanelofer-bejotufumizuw.pdf
    • http://drstellamedicalintuition.com/uploads/1/3/0/4/130489669/pafefezemasipe_kewoxugujisep_totapav_voziw.pdf
    • http://nuohotel-zh.devsite-1.com/uploads/1/3/0/3/130313111/130313111.html#agneepath+2012+movie+english+subtitles

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001064.bin
0b0bcdcd7de9f1ba9c1db80914bcdde2630289830f6e4b0cf57aed1ff883f8ee		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1064 8420 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.