Malicious PDF — malware analysis report

Static analysis result for SHA-256 4ece15fc34f65cd3…

MALICIOUS

PDF

48.5 KB Authoring application: Inkscape First seen: 2020-09-24
MD5: 50d7b7bfd42ea9327c7616b69585829d SHA-1: 0ed04ba9346b1ddc56c77219258b262c36417af9 SHA-256: 4ece15fc34f65cd347f124ce364ea5e26afc813bc0128d935a5112415cb62c2c
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF that contains embedded URLs pointing to other PDF files, suggesting a phishing or redirection attempt. The ClamAV detection and ML classifier strongly indicate malicious intent, likely related to phishing or malware distribution. The presence of embedded URLs and the document body's deceptive content indicate an attempt to trick users into downloading further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://nextbillionventures.com/uploads/1/3/0/6/130621277/nogekitibiputawiji.pdf PDF link annotation
    • http://usamwv.com/uploads/1/3/0/4/130483155/sisesimexexumor_jiwagodoril_dowov_nepul.pdfIn PDF document text
    • http://stjeromewestchester.org/uploads/1/3/0/3/130312976/633675e.pdfIn PDF document text
    • http://sylvainladouceur.com/uploads/1/3/0/4/130477775/mumavagomarogavu.pdfIn PDF document text
    • http://gumexiv.ted4mail.com/uploads/2020/01/28/6442cc45.pdfIn PDF document text
    • http://bartolomeilaw.com/uploads/1/3/0/6/130621283/130621283.html#bhojpuri+dance+songs+freeIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
    • https://savannah.gnu.org/projects/freefont/In PDF document text
    • http://www.gnu.org/licenses/In PDF document text
    • http://www.gnu.org/copyleft/gpl.htmlIn PDF document text
🗂 Part of campaign: delgiacconeuroarttherapy.com 17 samples

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000122e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x122E 7864 bytes
SHA-256: d83c7799de271daf58ec201dfe3e6740d4f5efd05564ac53031d09df37d200a7
font_01_sfnt_off00005af9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5AF9 16888 bytes
SHA-256: 598b436daaf3d122157f8aae4d95cb5f98998d7541b527c84c982bd0659a624f
font_02_sfnt_off000072a4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x72A4 9656 bytes
SHA-256: 6180729d9e8b3eee9824bc1c3d1999a861bb24c2475a5c2a338b39370c3c0f56

Open this report in the interactive analyzer, or submit your own file for analysis.