Malicious PDF — malware analysis report

Static analysis result for SHA-256 577f350ca4d33a61…

MALICIOUS

PDF

226.8 KB Authoring application: SWFTools
MD5: fac68a993f363d7ea656c367cbc88816 SHA-1: ce100ef74aed38f5d2c16b1b610aef26017d3515 SHA-256: 577f350ca4d33a6108f7c57b33cf0c11d5abaacbf4832678d25ae51711d1d394
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The PDF contains embedded URLs that likely lead to further malicious content, such as phishing pages or malware downloads. The presence of multiple similar URLs suggests a coordinated distribution effort. No scripts were extracted from this sample, limiting the ability to determine specific execution methods.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9464

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://aweddingphotographer.co.za/uploads/1/3/0/7/130775666/7959891.pdf
    • http://animatoradam.com/uploads/1/3/0/8/130874358/3296841ad6c4.pdf
    • http://curranttech.co/uploads/1/3/0/2/130291822/161040.pdf
    • http://reahomesllc.net/uploads/1/3/0/5/130589219/vuvavupido.pdf
    • http://www.alessioraschi.com/uploads/1/3/0/6/130620924/8fd45a5889e.pdf
    • http://mobilenaturalmedicine.com/uploads/1/3/0/6/130604512/zepobovop-mebezititun-sexutogebija-zofojufebibogi.pdf
    • http://www.paige-elizabeth-allen.com/uploads/1/3/0/4/130488885/bed5f5c.pdf
    • http://stonepinelabs.com/uploads/1/3/0/3/130379117/lagenudezokun.pdf
    • http://hostmaster.karonasound.co.uk/uploads/1/3/0/8/130814976/pivokotige.pdf
    • http://promo2018cn6a.com/uploads/1/3/0/8/130874318/manoziwowulaxomolo.pdf
    • http://napierpharmacy.co.nz/uploads/1/3/0/7/130775448/dumunejafu.pdf
    • http://dreamfurs.com/uploads/1/3/0/4/130435680/xiguwififo-feram.pdf
    • http://npzchs.site/uploads/1/3/0/5/130551249/nobasomujiv.pdf
    • http://www.watchitalltv.com/uploads/1/3/0/6/130604696/ae8d60.pdf
    • http://recruiting2care.com/uploads/1/3/0/4/130488067/zoware.pdf
    • http://host71.carmichaelnl.com/uploads/1/3/0/5/130539265/6835660.pdf
    • http://oohmami.co.uk/uploads/1/3/0/2/130289475/nopev_basegexusofiji.pdf
    • http://thomasaquinasbaltimore.org/uploads/1/3/0/6/130604590/f724e33b4ed9.pdf
    • http://natashagrover204.com/uploads/1/3/0/6/130620720/lepuwi-noxuwepof-torefekuv-jupef.pdf
    • http://1afkkh.bdgct.com/uploads/1/3/0/2/130289305/130289305.html#acc+guidelines+acs
    • http://hostmaster.karonasound.co.uk/upload

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003bc0.bin
f714a1cb896cdbdcf1539fda8d6f57a20ab3624282fe5af56a2b1de44633bfcb		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3BC0 16248 bytes
font_01_sfnt_off0000546b.bin
e0c4569a4fa96939bca568de4a71acb6be0c9c40342d89e6b973f04f7630c8f9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x546B 9472 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.