Malicious PDF — malware analysis report

Static analysis result for SHA-256 c5e868795ba4da7a…

MALICIOUS

PDF

47.0 KB Authoring application: Serif PagePlus
MD5: 6c1088f02065ff89c00af9a60d530097 SHA-1: f22386485bd7198120212ec0ac19a441bf742bba SHA-256: c5e868795ba4da7ad71375f4c780ee7642fe61558084274f2099e0b0b62877ab
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The file is identified as malicious by ClamAV with the signature Pdf.Phishing.TtraffRobotInstall-7605656-0. It contains multiple embedded URLs pointing to PDF files hosted on various domains, suggesting a phishing campaign. The document body, though containing some obfuscated text, mentions 'Hyundai h1 brochure pdf egypt', indicating a lure to trick users into downloading the malicious content.

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://maltaglasscreations.com/uploads/1/3/0/3/130313572/wivipujalekurok.pdf
    • http://thenepeanrowers.com/uploads/1/3/0/6/130639458/8bcee974d370e.pdf
    • http://alexandriasday.com/uploads/1/3/0/4/130483242/5297027.pdf
    • http://rbcdublin.org/uploads/1/3/0/6/130622083/8251714.pdf
    • http://cyclebavaria.com/uploads/1/3/0/2/130289638/130289638.html#hyundai+h1+brochure+pdf+egypt

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001009.bin
f2c02366ae436bc0266fb90da9719b97416f7044a25af80e715c7cde05b8069f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1009 8372 bytes
font_01_sfnt_off00005bd9.bin
bcc2ddcdbe5f1e67e8c45f178a0a176ce1fae8d5614c6e2d1ec0c0e619534a6e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5BD9 19160 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.