Malicious PDF — malware analysis report

Static analysis result for SHA-256 4f8ba651d5eb91da…

MALICIOUS

PDF

43.5 KB Authoring application: Pdftk
MD5: 89a2e46817375b80089b002cba8e9834 SHA-1: ec132d8027e9cceb2d62ec7fa882a31c912bf8b8 SHA-256: 4f8ba651d5eb91da11ffb5601fa729e7d6e802d0c0dd6ed882daaa2127d3975c
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The file is a PDF document that contains embedded links to external PDF and HTML files. The document body text, though heavily corrupted, appears to be related to a conference, likely a lure. The ClamAV heuristic 'Pdf.Phishing.TtraffRobotInstall-7605656-0' strongly suggests a phishing or malicious content delivery intent. The embedded URLs are likely used to host further stages of the attack or redirect the user to malicious sites.

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://flintcaucus.org/uploads/1/3/0/7/130740297/7745575.pdf
    • http://laurajentertainment.com/uploads/1/3/0/7/130776343/797933.pdf
    • http://talkupyouth.com/uploads/1/3/0/4/130476192/fugovolomub.pdf
    • http://nationalriskmanagementgroup.com/uploads/1/3/0/7/130776314/130776314.html#critical+discourse+analysis+conference+2018

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00000fa6.bin
fec50f4e55dec0d3fdf1d25f456656243f34a1bd2952ef033b0f089659b6703c		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFA6 8668 bytes
font_01_sfnt_off00005a64.bin
41d5c9cb4d60b7530e3cfd93a78efd430fe179aa57a8296e74fb8a971da4b0ee		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5A64 2600 bytes
font_02_sfnt_off000062f5.bin
f31c439e28d0137206b91a151f21343900f846ed9ff070250fbe82eb1cc7da1d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x62F5 16204 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.