Malicious PDF — malware analysis report

Static analysis result for SHA-256 f02b0dc1496ce6a2…

MALICIOUS

PDF

179.3 KB Authoring application: Inkscape
MD5: 22f49045de86b6fb2ba920d939773f14 SHA-1: 90956c19d1f2bdb1f181f4edb3e51d83fe775863 SHA-256: f02b0dc1496ce6a2393d87c945722aad88bf72927a64a9bd11c77bab25192765
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The file is a PDF document flagged by ClamAV as Pdf.Phishing.TtraffRobotInstall-7605656-0. It contains an embedded URI pointing to 'http://amanda-mccall.com/uploads/1/3/0/4/130483926/5969395.pdf', which is likely the malicious payload. The document body text is largely obfuscated but contains references to song titles and URLs, suggesting a social engineering lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.6800

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://amanda-mccall.com/uploads/1/3/0/4/130483926/5969395.pdf
    • https://puxuxutemabatos.weebly.com/uploads/1/3/0/5/130551249/3950044.pdf
    • http://kootenaycured.com/uploads/1/3/0/5/130551427/xefirupiberowo.pdf
    • http://miamilashsupply.com/uploads/1/3/0/7/130776138/36e17.pdf
    • http://monarchlax.com/uploads/1/3/0/4/130488615/4890764.pdf
    • http://shardexplorers.com/uploads/1/3/0/8/130815013/130815013.html#tonight+belongs+to+you+song

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000013a0.bin
f5eb1c948151937ebbe9a5893100c95ec38b6dd14a4a4f4170184f3e45e4ab8e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13A0 9836 bytes
font_01_sfnt_off00006e71.bin
378288d3133907284a1dd708aec606fa45674349f7e67e9eaedc79a8f6af9139		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6E71 16228 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.