Malicious PDF — malware analysis report

Static analysis result for SHA-256 f62bd593a97320ef…

MALICIOUS

PDF

44.9 KB Authoring application: Karbon First seen: 2020-09-24
MD5: 445f5e7f3ee33e280657676ff03c78d3 SHA-1: 1dfd1f9b67cd4dba7a71a5c2f3504097c74036e7 SHA-256: f62bd593a97320ef5d6d5804591f9e9e5a0606a0467180771ed72861f2d1047d
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The file was detected as malicious by multiple engines, including ClamAV, which identified it as Pdf.Phishing.TtraffRobotInstall-7605656-0. The document contains multiple external URLs, several of which are suspicious and likely serve as download locations for further malicious content. The presence of these URLs and the phishing classification strongly suggest a spearphishing attachment attack pattern.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://findingmybeautiful.com/uploads/1/3/0/7/130740572/4415800.pdf PDF link annotation
    • http://pug.100kakrd.ru/uploads/2020/01/27/lugoxekevupi_nupeze.pdfIn PDF document text
    • http://rexrussolaw.com/uploads/1/3/0/6/130604836/pebopalajikik.pdfIn PDF document text
    • http://55-podarok.site/uploads/1/3/0/4/130436159/130436159.html#even+and+odd+numbers+worksheets+grade+6In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Related samples 2

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00000ff2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFF2 8604 bytes
SHA-256: 9cc049fa7fc974e63f9a254a821ec502b34c1ccc030661c1b7cd830c05ea3c3c
font_01_sfnt_off00006899.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6899 16364 bytes
SHA-256: c374740700516b41f218ce1f3063ed30c57c5df665187242c67f0d0be227b05e

Open this report in the interactive analyzer, or submit your own file for analysis.