Malicious PDF — malware analysis report

Static analysis result for SHA-256 9b66fbd154ce66c3…

MALICIOUS

PDF

46.5 KB Authoring application: OpenOffice.org
MD5: dfbfc0468d690428558a9b45bbd9d14f SHA-1: b24f5c0656d2dade0d89c766eb7298a294c8c7e1 SHA-256: 9b66fbd154ce66c306917dd8fdabc688b246dbab1fe395e2390a37f26969c69d
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The file is a PDF document that contains multiple embedded URLs, all of which are unknown in reputation. The ClamAV detection and ML classifier strongly indicate maliciousness, specifically related to phishing. The document body, though partially corrupted, suggests a lure related to 'seizures in dogs video' to entice users to interact with the embedded links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://onlygodcanjudgeus.com/uploads/1/3/0/6/130605384/2607539.pdf
    • http://doctormabuse-themovie.com/uploads/1/3/0/4/130435898/efec862a.pdf
    • http://tij.dexterius.com/uploads/2020/01/28/sivufaxakesiz.pdf
    • http://wasileju.winfilm.ru/uploads/2020/01/28/5200509.pdf
    • http://nuohotel-zh.devsite-1.com/uploads/1/3/0/6/130603690/130603690.html#seizures+in+dogs+video

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001006.bin
08f25d161fa4d0a2400b891c70ac4a61e4380c87b1f51f63afc40d8ae264cfd9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1006 8632 bytes
font_01_sfnt_off00007083.bin
779aa567746046747dac965df7fdfb06ff632674a0a99ce247a327bf89f0fa63		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7083 16036 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.