Malicious PDF — malware analysis report

Static analysis result for SHA-256 99a63d65e41d80e2…

MALICIOUS

PDF

34.7 KB Authoring application: ImageMagick
MD5: 42959d6e7c25d5bef0480cb9452bc196 SHA-1: 3454e3a20ebb31bec02e5e93b1e8110b5a2bd3c2 SHA-256: 99a63d65e41d80e2a5fe37414333786641448a2dc69dfcb98c2c890c07d9a7e2
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The ClamAV heuristic 'Pdf.Phishing.TtraffRobotInstall-7605656-0' strongly suggests a phishing or malware distribution campaign. The presence of multiple external URLs embedded within the document, such as 'http://mosquitosaregone.com/uploads/1/3/0/5/130543262/varizulofaxifaxupe.pdf', indicates a likely attempt to redirect the user to a malicious site or download further malicious content. No scripts were extracted from this sample.

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://mosquitosaregone.com/uploads/1/3/0/5/130543262/varizulofaxifaxupe.pdf
    • http://randynazarian.com/uploads/1/3/0/6/130603956/3658803.pdf
    • http://hipsterleaks.com/uploads/1/3/0/3/130379377/22900.pdf
    • https://rosefudob.weebly.com/uploads/1/3/0/4/130483508/wogum-bowevuwolix-bodojofodewoxuz-budofoxe.pdf
    • http://priyagandhi.net/uploads/1/3/0/6/130620154/4955389.pdf
    • http://nationalriskmanagementgroup.com/uploads/1/3/0/8/130813117/130813117.html#powerpoint+how+to+improve+english+speaking+skills

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000010e2.bin
ebcb32bcb6c9fd34c60ab88fe39588c5d6d1f48a365349390e721c9a2193cbfe		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10E2 8284 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.