Malicious PDF — malware analysis report

Static analysis result for SHA-256 9686296b7da3a52e…

MALICIOUS

PDF

38.0 KB Authoring application: GIMP First seen: 2020-09-24
MD5: 83808214911b614dd389615e27224648 SHA-1: 9859a7530d0a37d6cd6c49d82686c1c038939a28 SHA-256: 9686296b7da3a52e89039cab6edbcee505a464b6325d93eea89b341c8b03ac06
114 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by multiple heuristics, including ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0'. The document body contains embedded URLs that are likely intended to redirect the user to malicious content or facilitate further infection. The presence of an external URI heuristic further supports the malicious intent of contacting external resources.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 4

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • QR-code redirect lure medium SE_QR_LURE
    Document instructs the user to scan a QR code with a phone — consistent with QR phishing, but also common in legitimate documents
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://twooneninedesignsandart.com/uploads/1/3/0/6/130604888/koterobuduf_xenuge_wajolepo_losunus.pdf PDF link annotation
    • http://myvisl.us/uploads/1/3/0/2/130272102/bizatez.pdfIn PDF document text
    • http://wadsworthupward.com/uploads/1/3/0/6/130603852/db6a96.pdfIn PDF document text
    • http://tovadokon.whoisthatvoice.com/uploads/2020/01/28/lafesonimi_kuxoda.pdfIn PDF document text
    • http://decojewelry.net/uploads/1/3/0/6/130605358/vugolilaxodex_valilanewemevez.pdfIn PDF document text
    • http://beingself-centered.com/uploads/1/3/0/2/130289225/130289225.html#anti+malware+for+androidIn PDF document text
🗂 Part of campaign: streetsmartyouthproject.org 3 samples

Related samples 2

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000010af.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10AF 8644 bytes
SHA-256: 2c430170b512486531fb5430493e8bf6c3f662af59eae94b095110fe152e7134

Open this report in the interactive analyzer, or submit your own file for analysis.