Malicious PDF — malware analysis report

Static analysis result for SHA-256 03695311355dc459…

MALICIOUS

PDF

44.3 KB Authoring application: Serif PagePlus
MD5: e0fc8274fdb29ff62ae27ea3b1ac31da SHA-1: 92e3480edb6b711878067a1d710381100b0eb6bc SHA-256: 03695311355dc4594f5d374fca4dce3fe6deaaa0ec53a6d0172db5daed6e2105
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded URLs pointing to other PDF files, a technique often used for SEO spam or to distribute malicious content. ClamAV detected this file as 'Pdf.Phishing.TtraffRobotInstall-7605656-0', and a machine learning classifier also flagged it as malicious. The document body contains garbled text and references to 'Orchestrator uipath platform', which appears to be a lure.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://michiesdogmeatsandtreats.com/uploads/1/3/0/4/130436224/1789160.pdf
    • http://biglifecc.com/uploads/1/3/0/5/130542822/286e19d3687d28.pdf
    • http://remaa.ca/uploads/1/3/0/2/130288729/jolumipore-dixulenubasi-wivigekibafopi-litikexewox.pdf
    • http://obxaerialads.com/uploads/1/3/0/4/130477083/monoxagoxazadud.pdf
    • http://nworparenting.com/uploads/1/3/0/5/130590588/bexadud.pdf
    • http://reneeyuengling.com/uploads/1/3/0/6/130620751/78e230d4e8a6.pdf
    • http://solidinvestmentgroupbvba.com/uploads/1/3/0/4/130436093/pemudeku-begazaw.pdf
    • http://vuwugakuf.kvipa.ru/uploads/2020/01/28/4732750.pdf
    • http://second-childhood.com/uploads/1/3/0/4/130477775/kumirujusoji.pdf
    • http://vusidedara.tanglamstore.com/uploads/2020/01/29/2720380.pdf
    • http://derwoodmarket.org/uploads/1/3/0/4/130489371/130489371.html#orchestrator+uipath+platform
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000012cb.bin
852d9fec6f688591214befe507870eb8d7824e0b3ec0b429c4d8368e4f652578		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12CB 9012 bytes
font_01_sfnt_off00006715.bin
b3affdfdfee497c2d3230853582529cf395d265bfdbb8cde7d84ae9c33602211		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6715 16036 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.