Malicious PDF — malware analysis report

Static analysis result for SHA-256 e25ee7ee7f2dc3f6…

MALICIOUS

PDF

48.7 KB Authoring application: Serif PagePlus
MD5: 1c0f3558f6c4c8d933c82338702b4c1b SHA-1: 9d25b12ea4598a1cae4dee68fb0217d98cfebeb2 SHA-256: e25ee7ee7f2dc3f6ff6a154f085d3820c74dc0e31fc19004f56909cd8e151caa
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The file was detected by ClamAV as Pdf.Phishing.TtraffRobotInstall-7605656-0 and flagged by an ML classifier, indicating malicious intent. The embedded URLs suggest a phishing or social engineering lure, aiming to trick the user into downloading further malicious content. The document body contains garbled text and embedded URLs, consistent with a phishing document.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://oregonprenup.com/uploads/1/3/0/5/130588294/70b3d97f60.pdf
    • http://sophiecharlottephotography.com/uploads/1/3/0/3/130313235/kikavuvili.pdf
    • http://nomoremondays.us/uploads/1/3/0/5/130589279/makada.pdf
    • http://nmarphotog.com/uploads/1/3/0/3/130313826/xajuw.pdf
    • http://monto.com.mx/uploads/1/3/0/6/130620293/jofiraz.pdf
    • http://allamericandogexpo.com/uploads/1/3/0/5/130588237/130588237.html#bike+ride+status+videos

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001059.bin
7d6d0b244d64f94661564613ce58bbb7d3f62e7f758931f9ee2a8eae20c0d118		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1059 8908 bytes
font_01_sfnt_off0000852f.bin
83459e82cebe561b9e65dda6a09953c9e35f75e5df0fa62a624e1833cc5b8086		 pdf-font-stream PDF embedded font (sfnt) at offset 0x852F 1708 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.