Malicious PDF — malware analysis report

Static analysis result for SHA-256 96d7bda3e58cb6d3…

MALICIOUS

PDF

53.2 KB Authoring application: Scribus
MD5: e90255662f2c42c6f23bfd2bb2b4b0cb SHA-1: 5e4cdc19c3dd588ee2e9cefcbf48941cb962d284 SHA-256: 96d7bda3e58cb6d3f5b889c8ece8c0937bbded0e7771bc0cfcbdd1b40232c914
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The file is a PDF document identified as malicious by ClamAV and an ML classifier. The document body suggests a lure related to a 'junior accountant last year paper'. The PDF contains multiple embedded URLs, one of which is also present in the PDF's URI field, indicating an attempt to redirect the user to malicious content. The ClamAV detection name 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a phishing or traffic redirection motive.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://bayareasofareviews.com/uploads/1/3/0/6/130604088/9ee024b76ec.pdf
    • http://muleartist.com/uploads/1/3/0/6/130604576/tofisodugifopin_wonizubed_gopurixuvo_zagevexokug.pdf
    • http://beyoutiful.ca/uploads/1/3/0/5/130590244/4552319.pdf
    • http://cecilyeiferle.com/uploads/1/3/0/3/130324386/130324386.html#jvvnl+junior+accountant+last+year+paper

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00000fed.bin
fb63a6a101537125d24646594ab6c9e5e90e2954ec6fc8b54f35bc03fcc0d7b6		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFED 8380 bytes
font_01_sfnt_off00007445.bin
1723f1ced37cc89d69e30f3df6281c5e5fb8989544fd4587aa75b00c91af2fd0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7445 1388 bytes
font_02_sfnt_off00007d46.bin
5e72ecea4161a4bae297a05bda54a00d34c858754d24e269e7253149a50ca30e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7D46 12780 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.