Malicious PDF — malware analysis report

Static analysis result for SHA-256 4f8ba651d5eb91da…

MALICIOUS

PDF

43.5 KB Authoring application: Pdftk First seen: 2020-09-24
MD5: 89a2e46817375b80089b002cba8e9834 SHA-1: ec132d8027e9cceb2d62ec7fa882a31c912bf8b8 SHA-256: 4f8ba651d5eb91da11ffb5601fa729e7d6e802d0c0dd6ed882daaa2127d3975c
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document that contains multiple embedded URLs pointing to other PDF files hosted on external websites. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the ML classifier strongly indicate malicious intent, likely for phishing or malware distribution. The embedded URLs are the primary indicators of compromise, suggesting a multi-stage attack where this PDF acts as a lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://flintcaucus.org/uploads/1/3/0/7/130740297/7745575.pdf PDF link annotation
    • http://laurajentertainment.com/uploads/1/3/0/7/130776343/797933.pdfIn PDF document text
    • http://talkupyouth.com/uploads/1/3/0/4/130476192/fugovolomub.pdfIn PDF document text
    • http://nationalriskmanagementgroup.com/uploads/1/3/0/7/130776314/130776314.html#critical+discourse+analysis+conference+2018In PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://fedoraproject.org/wiki/Licensing/LiberationFontLicenseIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00000fa6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFA6 8668 bytes
SHA-256: fec50f4e55dec0d3fdf1d25f456656243f34a1bd2952ef033b0f089659b6703c
font_01_sfnt_off00005a64.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5A64 2600 bytes
SHA-256: 41d5c9cb4d60b7530e3cfd93a78efd430fe179aa57a8296e74fb8a971da4b0ee
font_02_sfnt_off000062f5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x62F5 16204 bytes
SHA-256: f31c439e28d0137206b91a151f21343900f846ed9ff070250fbe82eb1cc7da1d

Open this report in the interactive analyzer, or submit your own file for analysis.