Malicious PDF — malware analysis report

Static analysis result for SHA-256 d20d7485dd355e57…

MALICIOUS

PDF

33.2 KB Authoring application: Scribus
MD5: 6be5c797216a940a0e9c8fbe7ebd11eb SHA-1: 9bc45451f3e5b74d26a5cc718d19f133ce533288 SHA-256: d20d7485dd355e5787074b1a79100d9e2155a33da2e2942d866b28625991ff0b
62 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The PDF file contains multiple embedded URLs, all pointing to suspicious PDF or HTML files on various domains. The ClamAV heuristic 'Pdf.Phishing.TtraffRobotInstall-7605656-0' strongly suggests a phishing or malware distribution intent. The document body, though heavily obfuscated, mentions 'Dyno bot custom commands', which appears to be a lure to encourage the download of further malicious content.

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://xigami.artlawyer.ru/uploads/2020/01/27/8264559.pdf
    • http://vigineg.daikabin.com/uploads/2020/01/27/ribave.pdf
    • http://ziro.web-delo.icu/uploads/2020/01/28/f9a7e31.pdf
    • http://savup.paiementfm.fr/uploads/2020/01/27/d28b8c11633d1ad.pdf
    • http://gav.kyrortymira.ru/uploads/2020/01/27/8e407a9.pdf
    • http://namoduxumi.remstroi-metal.ru/uploads/2020/01/28/kemoj-rodovefegejija-jokoxemaxa.pdf
    • http://kus.inverautosrenault.com/uploads/2020/01/28/8671b6ee43ef16.pdf
    • http://gotinevev.javagala.info/uploads/2020/01/28/gunigig.pdf
    • http://rudetinaz.seo-spytnik.com/uploads/2020/01/28/reluzuladoludop-gupopakiwiguwal-bewogemajadijix-nuvuxigifuduve.pdf
    • http://richardwm.online/uploads/79123996.html#dyno+bot+custom+commands

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001245.bin
7549cd29f29af089270f4e18dbfcd9d7d5b9d167768433ce77aef6e1423e8617		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1245 8616 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.