Malicious PDF — malware analysis report

Static analysis result for SHA-256 dfe8ab5f18a7c9a3…

MALICIOUS

PDF

42.3 KB Authoring application: Inkscape First seen: 2020-09-24
MD5: d0d608a20866685e5a286c1b2f7ef281 SHA-1: 5b8c55912f4d8f98e33821f67f96335754319e7c SHA-256: dfe8ab5f18a7c9a341dfeda40897e7060e588853d7bbde191f3251575c00e343
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains embedded URLs that redirect to other PDF files, suggesting a phishing or malware distribution scheme. The ML classifier and ClamAV detection strongly indicate malicious intent, likely related to phishing or malware delivery. The document body, though partially obfuscated, mentions 'free pencil calligraphy worksheets pdf', serving as a lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://vixofijitobe.weebly.com/uploads/1/3/0/3/130379314/7270951.pdf PDF link annotation
    • http://fournildejean.com/uploads/1/3/0/6/130604821/ca71a3.pdfIn PDF document text
    • http://xavi.sascharoseescort.com/uploads/2020/01/28/3288763.pdfIn PDF document text
    • http://lopolis.net/uploads/1/3/0/6/130621460/744188.pdfIn PDF document text
    • http://northwestuu.com/uploads/1/3/0/6/130604517/130604517.html#free+pencil+calligraphy+worksheets+pdfIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Related samples 1

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001052.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1052 8716 bytes
SHA-256: 3d128a1eb9ca846becff48f744e25798378099122300e0e37b37f445118286f0
font_01_sfnt_off00005ecb.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5ECB 16192 bytes
SHA-256: b3e61b7d7b8dbcb25e06124f2613e424f2009472c0f20d06ef3485b30c070708

Open this report in the interactive analyzer, or submit your own file for analysis.