Malicious PDF — malware analysis report

Static analysis result for SHA-256 02f79a06773e10a6…

MALICIOUS

PDF

74.1 KB Authoring application: QPDF
MD5: b3901ae704cb1ce8cb5cf815154dfa50 SHA-1: 21f3425a71e04bc215795c07e2070dbd9de1372f SHA-256: 02f79a06773e10a6184eb78e7c4fac5be5ee30061206b76914dbeeaeba96001d
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of embedded external links, as indicated by the PDF_SEO_LINK_FARM heuristic. ClamAV also detected this as Pdf.Phishing.TtraffRobotInstall, suggesting a phishing or malicious redirection intent. The document body contains text related to the 'Argentina fiba world cup 2019 roster' and includes several URLs, reinforcing the idea of a lure to external content. The ML classifier strongly flagged this PDF as malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9986

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://nortonbio.com/uploads/1/3/0/6/130605332/vedudedizegevanibed.pdf
    • http://fut.party/uploads/1/3/0/5/130588679/newudala.pdf
    • http://makingcollegemorecommon.com/uploads/1/3/0/2/130287428/9fe1bbf1bb.pdf
    • http://nicolejonestroy.com/uploads/1/3/0/5/130590295/bogen_papixesesitizo_bewosoroperi.pdf
    • http://colddiamnd.com/uploads/1/3/0/6/130621496/130621496.html#argentina+fiba+world+cup+2019+roster
    • http://fiba.com/subYT
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://fedoraproject.org/wiki/Licensing/LiberationFontLicense

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000011ac.bin
c539d6fdd17e6004099e5983a5728b86845eb97f086e997f29f66514baccd03d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11AC 10696 bytes
font_01_sfnt_off0000e9b2.bin
61ec830ad2cf284ca210b16d2bf5925b48f491a57ac9871a4b27af5be50ac37f		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE9B2 2612 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.