Malicious PDF — malware analysis report

Static analysis result for SHA-256 94212aa6be604026…

MALICIOUS

PDF

38.0 KB Authoring application: Inkscape
MD5: 7df37b3d4c01ef8a3c0239af90e4c50e SHA-1: e84ff247feafe404cc1685e586b2a8833e01160a SHA-256: 94212aa6be604026e31f54e520ae9e25f5e3de2979489711f4d5b4ab05aab2c2
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment

The file is a PDF document that contains embedded URLs pointing to other PDF files. The document body, despite being heavily obfuscated, mentions 'Funny christmas invitations templates free' and includes several URLs that are likely part of a phishing or malware distribution campaign. The ClamAV heuristic 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports the phishing classification.

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cawatercareers.com/uploads/1/3/0/7/130776309/rebadat.pdf
    • http://101taiwantour.com/uploads/1/3/0/4/130435597/3785717.pdf
    • http://isfnrconf.org/uploads/1/3/0/6/130621708/jimizabavesowanedez.pdf
    • https://sebuvajuga.weebly.com/uploads/1/3/0/2/130289563/gabobebas.pdf
    • http://leveilmassagetestsite.weebly.com/uploads/1/3/0/3/130313122/kudofopozo-gadubixuvolu-rebixusem-zelazifazawajuv.pdf
    • http://rochecenter.org/uploads/1/3/0/6/130604744/130604744.html#funny+christmas+invitations+templates+free

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000010f6.bin
67233741e0502ee83cedfcca621c8ab4c3dc6481324ff7e05de1803cc9a7e1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10F6 8880 bytes
font_01_sfnt_off000054f9.bin
474ec73df1b36e85887c1d7484355f454878283230f8235254da14555d14dd0d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x54F9 4380 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.