Malicious PDF — malware analysis report

Static analysis result for SHA-256 9b66fbd154ce66c3…

MALICIOUS

PDF

46.5 KB Authoring application: OpenOffice.org First seen: 2020-09-24
MD5: dfbfc0468d690428558a9b45bbd9d14f SHA-1: b24f5c0656d2dade0d89c766eb7298a294c8c7e1 SHA-256: 9b66fbd154ce66c306917dd8fdabc688b246dbab1fe395e2390a37f26969c69d
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The file is a PDF document that contains multiple embedded URLs, all of which are unknown in reputation. The ClamAV detection and ML classifier strongly indicate maliciousness, specifically related to phishing. The document body, though partially corrupted, suggests a lure related to 'seizures in dogs video' to entice users to interact with the embedded links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://onlygodcanjudgeus.com/uploads/1/3/0/6/130605384/2607539.pdf PDF link annotation
    • http://doctormabuse-themovie.com/uploads/1/3/0/4/130435898/efec862a.pdfIn PDF document text
    • http://tij.dexterius.com/uploads/2020/01/28/sivufaxakesiz.pdfIn PDF document text
    • http://wasileju.winfilm.ru/uploads/2020/01/28/5200509.pdfIn PDF document text
    • http://nuohotel-zh.devsite-1.com/uploads/1/3/0/6/130603690/130603690.html#seizures+in+dogs+videoIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Related samples 1

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001006.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1006 8632 bytes
SHA-256: 08f25d161fa4d0a2400b891c70ac4a61e4380c87b1f51f63afc40d8ae264cfd9
font_01_sfnt_off00007083.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7083 16036 bytes
SHA-256: 779aa567746046747dac965df7fdfb06ff632674a0a99ce247a327bf89f0fa63

Open this report in the interactive analyzer, or submit your own file for analysis.