Malicious PDF — malware analysis report

Static analysis result for SHA-256 0184e8b2247607b9…

MALICIOUS

PDF

40.1 KB Authoring application: Pdftk
MD5: fd3f6eaeb7a8578722d2338440cebdec SHA-1: 4b4c9c0b8267c4f054407b8a30a387ac3ffaacc2 SHA-256: 0184e8b2247607b97a30e21733b0e7161609740969e6c911c9d4c351c62aab68
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF contains a large number of embedded URLs disguised as an IELTS reading passage, a common lure for phishing or malware delivery. The heuristic 'PDF_SEO_LINK_FARM' specifically indicates a mass of external PDF links, with the first being http://mulek.notaorg.ru/uploads/2020/01/27/jobosakupote.pdf. The ML classifier and ClamAV detection further support its malicious nature, flagging it as phishing and a potential installer.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://mulek.notaorg.ru/uploads/2020/01/27/jobosakupote.pdf
    • http://lusafilut.vipiski-besplatno43.icu/uploads/2020/01/28/237941.pdf
    • http://spayedkoolie.com/uploads/1/3/0/3/130313161/8433377.pdf
    • https://zixilizitifudi.weebly.com/uploads/1/3/0/3/130313170/kabinanafaduleg-miwixu-joxuzexi.pdf
    • http://fexuluguda.blendsa.com/uploads/2020/01/28/7922991.pdf
    • http://mynaturalhairspa.com/uploads/1/3/0/4/130476098/130476098.html#ielts+reading+passage+3+forests+are+one+of+the+main
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000010bf.bin
af8bff5a71c0420b6c19c0f9fd410be122db600de89c4806965700ac3150439d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10BF 8124 bytes
font_01_sfnt_off0000560a.bin
5687c5217bc54965024825883fd2306a4c0bb03e7ffae84c867e683966742750		 pdf-font-stream PDF embedded font (sfnt) at offset 0x560A 16148 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.