Malicious PDF — malware analysis report

Static analysis result for SHA-256 90f066c7c364c176…

MALICIOUS

PDF

29.2 KB Authoring application: pdf-parser First seen: 2020-09-24
MD5: 0e73a49d5ad09fb7bc24ec8d0321e724 SHA-1: a6753ef50bb00dcdca0420fa8ada2505bd024867 SHA-256: 90f066c7c364c17633293531220aff3578f263a558f1647c12ff242c9ba79e89
114 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The document body contains embedded URLs that likely lead to the download of further malicious content, such as other PDFs. The presence of these URLs and the nature of the detection suggest a phishing or credential harvesting attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • QR-code redirect lure medium SE_QR_LURE
    Document instructs the user to scan a QR code with a phone — consistent with QR phishing, but also common in legitimate documents
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://atlantadrummethod.com/uploads/1/3/0/5/130551418/kigagolunexo_nililofe_ladizavod_buzebemej.pdf PDF link annotation
    • http://splashsteamboat.org/uploads/1/3/0/4/130489800/8915473.pdfIn PDF document text
    • http://hot100project.com/uploads/1/3/0/6/130639885/vigeporanole.pdfIn PDF document text
    • http://icbrconference.org/uploads/1/3/0/7/130775939/a655e428629b1.pdfIn PDF document text
    • http://sharedtravel.voyagerwebsites.com/uploads/1/3/0/7/130740618/130740618.html#5+inches+ruler+actual+sizeIn PDF document text

Related samples 1

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000100e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x100E 7804 bytes
SHA-256: 4a81bd71889f16030b577897b86338c294722d69b2ad6f15fde2c7af480671e7

Open this report in the interactive analyzer, or submit your own file for analysis.