Malicious PDF — malware analysis report

Static analysis result for SHA-256 edccb84de07adb6a…

MALICIOUS

PDF

38.5 KB Authoring application: Pdftk First seen: 2020-09-07
MD5: 4bbc66880c06cbc831982acbbe7aead1 SHA-1: db2b444cfb5332b0473f976edaa7814f6cf54796 SHA-256: edccb84de07adb6a6bd91328de3dbd0d68bf346fb6cc0f44de8884657cea53fa
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains embedded URLs pointing to external PDF files, suggesting a phishing or social engineering lure. The presence of these URLs and the overall detection suggest the document is designed to trick users into visiting malicious sites or downloading further malware.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://roka.flowers-sale.ru/uploads/2020/01/28/jazudizasimob-belojidozado.pdf PDF link annotation
    • http://narrinspiceandsauce.com/uploads/1/3/0/4/130476248/9dcb024.pdfIn PDF document text
    • http://andreanelsonart.com/uploads/1/3/0/2/130271143/fatefob-masuwan-mikoliwokaroro.pdfIn PDF document text
    • http://2020blue.org/uploads/1/3/0/6/130621625/130621625.html#black+checkered+vans+platformIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Related samples 4

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000101d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x101D 8560 bytes
SHA-256: 821481c8db60ff587a1613142954675410052c2aca5ac38979e9a14163056ad8
font_01_sfnt_off0000491d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x491D 18344 bytes
SHA-256: 094359120818baad251b372eb0b1a3904e7059b25e94b8f19687b70a58d39ccd

Open this report in the interactive analyzer, or submit your own file for analysis.