Malicious PDF — malware analysis report

Static analysis result for SHA-256 e0a683211b7a3453…

MALICIOUS

PDF

154.2 KB Authoring application: Soda PDF First seen: 2020-09-24
MD5: 833851a9f92b6247a4c6c6530559b478 SHA-1: 00faa49bb3ee0278e7422f4577a3c1feb00f0896 SHA-256: e0a683211b7a3453393025115e4bb9bd8c60c0a05993b19a5292b6237b6d6599
174 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The file is identified as a PDF document exhibiting characteristics of an advance-fee scam, specifically mentioning lottery or parcel delivery lures. The presence of embedded URLs suggests a redirection to further malicious content or phishing pages. ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports the phishing and potential payload delivery intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8714

Heuristics 5

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • Fake encrypted/secure-document view lure high SE_ENCRYPTED_DOC_LURE
    Document claims to be an encrypted or protected file that must be opened through a 'secure view' link, and the action link uses deceptive infrastructure. This is the secure-document credential-phishing carrier: the page imitates a secure-mail / document-cloud gate while the link leads to a harvesting site. action link to abused redirector.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://70008922.nhd.weebly.com/uploads/1/3/0/2/130289723/2597507.pdf PDF link annotation
    • https://vigapatak.weebly.com/uploads/1/3/0/4/130436313/972385.pdfIn PDF document text
    • http://shopjollygoods.com/uploads/1/3/0/3/130312961/6a632e1e3.pdfIn PDF document text
    • http://solomanproject.com/uploads/1/3/0/6/130620382/tufazuxamomaxa.pdfIn PDF document text
    • http://talipi.supersfereon.fun/uploads/2020/01/29/seduvunu-zinivureludoxo.pdfIn PDF document text
    • http://wearmonster.com/uploads/1/3/0/5/130590410/8aa7bf3910cf17.pdfIn PDF document text
    • http://mysouthshorecharteracademy.com/uploads/1/3/0/3/130379777/bd783.pdfIn PDF document text
    • http://contractorwholesale.com/uploads/1/3/0/4/130483649/suzomudiz-zadimutukutixu.pdfIn PDF document text
    • http://dad.tht-premiere.online/uploads/2020/01/28/6431017.pdfIn PDF document text
    • http://nkbadvisors.com/uploads/1/3/0/6/130604766/nirikasuzuzuguw-loviwirabeputaz.pdfIn PDF document text
    • http://vanmarkitonmusic.com/uploads/1/3/0/7/130775539/tiwumo.pdfIn PDF document text
    • http://holdenshouseco.com/uploads/1/3/0/6/130621484/mekesabifa-lofifesanuj-zovut.pdfIn PDF document text
    • http://multistreams.com/uploads/1/3/0/4/130491075/130491075.html#whatsapp+calling+applicationIn PDF document text
    • http://linux.thai.net/projects/fonts-tlwgIn PDF document text
    • http://www.thaitux.infoIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
    • http://www.adobe.com/).NotoIn PDF document text
    • http://www.google.com/get/noto/http://www.adobe.com/type/ThisIn PDF document text
    • http://scripts.sil.org/OFLNotoIn PDF document text
    • https://savannah.gnu.org/projects/freefont/In PDF document text
    • http://www.gnu.org/licenses/In PDF document text
    • http://www.gnu.org/copyleft/gpl.htmlIn PDF document text
    • https://fedoraproject.org/wiki/Licensing/LiberationFontLicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 7

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_004_off0001151c.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x1151C 19748 bytes
SHA-256: 6a7122089c965b5d62955752fc527cfb3af2b578f66cc3cc50739b68d83a4acc
font_00_sfnt_off00001723.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1723 16380 bytes
SHA-256: 253ff5fe6d1a0f46251d9d95abb8ba938a32610e2f508a847e86604683b5adc6
font_02_sfnt_off0001cb92.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1CB92 6908 bytes
SHA-256: 03742b3af56d0894ab5df65dc3134d6d1f1537ecfbbc759efc3d5c9763d8381a
font_03_sfnt_off0001e152.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1E152 10240 bytes
SHA-256: bbd465158f88620f6b89bbc14fd4053a393fda34b464cf5d9625b9580ee6f51f
font_04_sfnt_off0001f71d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1F71D 8480 bytes
SHA-256: 868a07a666c5032a714f2e4aaba4b67d05df30d312a0dd626753a432c02aa9de
font_05_sfnt_off00020d6b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x20D6B 8400 bytes
SHA-256: 99c5193cfd8c036c1ae011c773f5a8e9b9247b36e3e6dc2fbfbefde82fa9f0cc
font_06_sfnt_off000223ec.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x223EC 3508 bytes
SHA-256: 4c93801c4768b9cf34ec960e4f85d683fdbe353adcc5a9e70f9f8b41c5e92470

Open this report in the interactive analyzer, or submit your own file for analysis.