Malicious PDF — malware analysis report

Static analysis result for SHA-256 fbe267e0845f65a4…

MALICIOUS

PDF

181.1 KB Authoring application: Adobe PDF Library 9.0 First seen: 2020-06-02
MD5: b8577f05011c287187c0b0c222bde26b SHA-1: 804b234d7d0570a379048baa70adb264df62314b SHA-256: fbe267e0845f65a4f5831e7b668f06911d57ab604c013943563ce61d7ee9f922
102 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF file was flagged by multiple heuristics, including a critical ClamAV detection for 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and an ML classifier indicating maliciousness. The document body contains numerous embedded URLs, suggesting it acts as a lure to download further malicious content. The presence of urgency language further supports a phishing or social engineering attack vector.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9733

Heuristics 4

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Urgency / deadline lure low SE_URGENCY_LURE
    Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://guzilo.uahim-dev.ru/uploads/2020/01/28/nesulutis-laven-kejolavasisod-lanomeposov.pdf PDF link annotation
    • http://kidigenal.ledy-boss.su/uploads/2020/01/28/1059269.pdfIn PDF document text
    • http://45northfarm.com/uploads/1/3/0/5/130551607/sefajupelibobiba.pdfIn PDF document text
    • http://alexandraforsythermt.com/uploads/1/3/0/4/130489523/gexigunesumaz.pdfIn PDF document text
    • http://pokuzuxanu.sadad-eh.icu/uploads/2020/01/29/7ca8ec372b4.pdfIn PDF document text
    • http://peachtreehome.net/uploads/1/3/0/5/130588640/juruxuri.pdfIn PDF document text
    • https://jogodijijutixax.weebly.com/uploads/1/3/0/4/130483540/c7f02ec88a3b9c8.pdfIn PDF document text
    • http://shiawati.ru/uploads/2020/01/28/9910611.pdfIn PDF document text
    • http://kodubudiv.tv-android.ru/uploads/2020/01/28/xupuri.pdfIn PDF document text
    • http://kafelkafel.ru/uploads/2020/01/27/9761637.pdfIn PDF document text
    • http://judgescottdonaldson.com/uploads/1/3/0/6/130639603/ginivajevelis-sezefit.pdfIn PDF document text
    • http://bfroblaw.com/uploads/1/3/0/5/130590140/3580597.pdfIn PDF document text
    • http://aliamiri-lifehacks.com/uploads/1/3/0/6/130620979/7883297.pdfIn PDF document text
    • http://4100expressave.com/uploads/1/3/0/4/130476496/9ed51.pdfIn PDF document text
    • http://grunwald.tech/uploads/2020/01/27/3948437.pdfIn PDF document text
    • http://xujaxarul.sector-arm.ru/uploads/2020/01/28/fuxegeriwoputaxejo.pdfIn PDF document text
    • http://djjeremiah.com/uploads/1/3/0/5/130550895/5c3d55286fa482c.pdfIn PDF document text
    • http://kjplumbingin.com/uploads/1/3/0/2/130287493/5749005.pdfIn PDF document text
    • http://jonathanecollins.com/uploads/1/3/0/4/130489926/podemolonas-resedomij-metosejij.pdfIn PDF document text
    • http://micabotanicals.com/uploads/1/3/0/2/130272284/megavupobaxerukuvi.pdfIn PDF document text
    • http://knitvegan.com/uploads/1/3/0/5/130589195/3426358.pdfIn PDF document text
    • http://bsa-sccc-pack301.com/uploads/1/3/0/6/130621411/130621411.html#deepwater+horizon+underwater+videoIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://fedoraproject.org/wiki/Licensing/LiberationFontLicenseIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
🗂 Part of campaign: alexandraforsythermt.com 5 samples

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001254.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1254 10044 bytes
SHA-256: 2ccf151131851e6ea6736c8d68405f02bfcf05c3821374747ac401b2039ecee2
font_01_sfnt_off0001e1c8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1E1C8 2680 bytes
SHA-256: 6255f36c60422f65bde87fb2f81ef5f15d7d612e9b4ff346c26f1af97b4559e6
font_02_sfnt_off0002874d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2874D 16036 bytes
SHA-256: 779aa567746046747dac965df7fdfb06ff632674a0a99ce247a327bf89f0fa63

Open this report in the interactive analyzer, or submit your own file for analysis.