Malicious PDF — malware analysis report

Static analysis result for SHA-256 e9a1fad1bbf3eee7…

MALICIOUS

PDF

27.0 KB Authoring application: QPDF
MD5: d64156e745fd8b155cf14afb03eeb97b SHA-1: 29cff7fb263b49538c8b565d32e8269a52ceb815 SHA-256: e9a1fad1bbf3eee73b2f8fb4fc9c445d454276e9b55c30e6236092d5d846bd22
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The file is a PDF document that contains embedded URLs pointing to external PDF files. The document body text mentions 'Mahindra finance car loan noc format', suggesting a phishing lure related to financial documents. The presence of multiple suspicious URLs and a high ML classifier score indicate malicious intent, likely to trick users into downloading further malicious content. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports this assessment.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://q72spiceco.com/uploads/1/3/0/4/130483587/xatukanuwoge.pdf
    • http://cookstown.ca/uploads/1/3/0/2/130287945/960ec.pdf
    • http://kix.fuck4me.top/uploads/2020/01/28/28db844e200.pdf
    • http://jenavabex.nordstar-tower.ru/uploads/2020/01/28/rupax.pdf
    • http://audioallure.com/uploads/1/3/0/4/130489361/9850612.pdf
    • http://csobecancour-en.com/uploads/1/3/0/6/130621829/130621829.html#mahindra+finance+car+loan+noc+format

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00000ffa.bin
e6aab20c683f9e62d28e0fada4ad7437e126bd2710ae0fd7dc565c77c4cdf844		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFFA 7392 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.