Malicious PDF — malware analysis report

Static analysis result for SHA-256 cdd6b0a472f42e8a…

MALICIOUS

PDF

32.7 KB Authoring application: Serif PagePlus
MD5: f5b054edf76ff96cbb319439bf4d1e6a SHA-1: efe4df3788a4ee8e06a0e83a4291a90e6d6958e5 SHA-256: cdd6b0a472f42e8a9b1b502d6d8281e9ebc9da9fc675a853f15e75c9cd86a2d7
78 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The file is a PDF containing JavaScript and embedded URLs, identified by ClamAV as Pdf.Phishing.TtraffRobotInstall. The document body includes a call-to-action phrase and multiple external URLs, suggesting a phishing or malware distribution attempt. The presence of JavaScript indicates an attempt to execute malicious code, likely to download further payloads from the listed URLs.

Heuristics 5

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://carminarevert.xyz/uploads/1/3/0/6/130604820/setemiwusizo.pdf
    • http://onehikeatatime.com/uploads/1/3/0/3/130379228/zupididorikopof.pdf
    • http://famowi.tatarstan.travel/uploads/2020/01/28/a607bef.pdf
    • http://nomnomgelato.com/uploads/1/3/0/5/130546497/ae03b7606d276ef.pdf
    • http://chandalinchamplin.net/uploads/1/3/0/5/130544448/munosuzusakowibaj.pdf
    • http://ankezimmermann.ca/uploads/1/3/0/5/130589077/130589077.html#6th+to+10th+book+back+questions+and+answers+pdf+download

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000010ec.bin
f6a559d984883b88dbd2ee26e44c8e4176de4802cc1a8e54838f2249f3d194dc		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10EC 8352 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.