Malicious PDF — malware analysis report

Static analysis result for SHA-256 86a2c68949800475…

MALICIOUS

PDF

179.9 KB Authoring application: ImageMagick First seen: 2020-09-24
MD5: 5287695950004411de1b540a08f8cb8d SHA-1: eb89a21d86300a6c34bcb10cd7b80226797e1298 SHA-256: 86a2c68949800475b2bdaf8ed5e715e6a70b4e6b769528f5002b22146aba137f
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains numerous embedded URLs, one of which is http://bsafet.net/uploads/1/3/0/3/130324418/dumexipusupupesanaj.pdf, suggesting it is part of a phishing campaign designed to trick users into downloading further malicious content. The document body's content is heavily obfuscated and does not provide clear instructions, but the overall structure and heuristic firings point to a phishing lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9783

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://bsafet.net/uploads/1/3/0/3/130324418/dumexipusupupesanaj.pdf PDF link annotation
    • http://dcmserviceinc.com/uploads/1/3/0/2/130289655/dozuni-verezugovalen.pdfIn PDF document text
    • http://webmail.chrissieparker.com/uploads/1/3/0/8/130874077/504877d243dc4b7.pdfIn PDF document text
    • http://christlife.blog/uploads/1/3/0/5/130588529/1616966.pdfIn PDF document text
    • http://gameandsoft.store/uploads/1/3/0/3/130313031/nefoxiso_mesevaz.pdfIn PDF document text
    • http://yourluvyoga.com/uploads/1/3/0/3/130313274/masebidov.pdfIn PDF document text
    • http://cottageandcheese.com/uploads/1/3/0/8/130813903/zujodazogilizozilimu.pdfIn PDF document text
    • http://mta-sts.tampereenfreet.net/uploads/1/3/0/7/130776607/1db1bb55.pdfIn PDF document text
    • http://www.paulelderlocal290.com/uploads/1/3/0/7/130739552/tugodobip.pdfIn PDF document text
    • http://crankybaker.com/uploads/1/3/0/4/130488542/mituzinenujufetawad.pdfIn PDF document text
    • http://socialsnapphotoboothlasvegas.com/uploads/1/3/0/4/130488227/temubivotazas_bidim_zubiliguvalibe_fasobijub.pdfIn PDF document text
    • http://webdisk.mindfulday.org/uploads/1/3/0/8/130874163/denifinebopotokidoz.pdfIn PDF document text
    • http://vega-music-group.com/uploads/1/3/0/6/130604447/nimavinezoki.pdfIn PDF document text
    • http://bucketlisthacks.com/uploads/1/3/0/5/130540402/857d0.pdfIn PDF document text
    • http://e4mafiacoffeecompany.com/uploads/1/3/0/2/130289782/6278902.pdfIn PDF document text
    • http://wildywell.com/uploads/1/3/0/3/130313433/1983859.pdfIn PDF document text
    • http://visionpolaris.com/uploads/1/3/0/4/130489123/pebibozubamimud_zufotosiwi_kefejekobisoji_fujitogutuwevek.pdfIn PDF document text
    • http://cranstonroofingservices.com/uploads/1/3/0/6/130620649/e8508452d691.pdfIn PDF document text
    • http://wet4u.net/uploads/1/3/0/6/130622120/4fc57e3d1a12a.pdfIn PDF document text
    • http://duplexdoctor.com/uploads/1/3/0/4/130476563/pinusenok.pdfIn PDF document text
    • http://rep-christ.com/uploads/1/3/0/6/130621803/vafepu.pdfIn PDF document text
    • http://noxanima.com/uploads/1/3/0/5/130589095/xewuwerokomavubonol.pdfIn PDF document text
    • http://mywholelifeisshirts.com/uploads/1/3/0/5/130589309/gariwepukumozifoxe.pdfIn PDF document text
    • http://baudlbears.com/uploads/1/3/0/2/130289421/7971825.pdfIn PDF document text
    • http://www.renustone.ca/uploads/1/3/0/7/130740292/xumigufufobogew.pdfIn PDF document text
    • http://bshppopup.com/uploads/1/3/0/8/130873829/130873829.html#english+and+amharic+alphabet+pdfIn PDF document text
    • http://scripts.sil.orgThisIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
    • http://scripts.sil.org/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://scripts.sil.org/OFLAbyssinicaIn PDF document text
    • https://fedoraproject.org/wiki/Licensing/LiberationFontLicenseIn PDF document text
    • https://savannah.gnu.org/projects/freefont/In PDF document text
    • http://www.gnu.org/licenses/In PDF document text
    • http://www.gnu.org/copyleft/gpl.htmlIn PDF document text
🗂 Part of campaign: cinno.ca 9 samples

Related samples 3

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000022c6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x22C6 19012 bytes
SHA-256: 99348fdcb8c5b34425e6c6d02c8e005a8370c1b3d012a7b27603a5b46407e42c
font_01_sfnt_off0000445a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x445A 11080 bytes
SHA-256: bf11fd7257a3ff296c9701d4c5e5b5a0a4d051a5636c7ae6b86d3a2062a46768
font_02_sfnt_off0001468c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1468C 20732 bytes
SHA-256: 32bffed910ea6ccafb0eaa48b79711e7839d10b8596bf2a67ea79487d6c63db1
font_03_sfnt_off00016543.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x16543 3084 bytes
SHA-256: a019e1f040155e6822006c01897c3a327628c2ae71222fcecd9433cac78e864c
font_04_sfnt_off000178a6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x178A6 127396 bytes
SHA-256: 39388973bcadcaed546ceb4cc011b49bea3d07820dcf957dec57aa30fff88a56

Open this report in the interactive analyzer, or submit your own file for analysis.