Malicious PDF — malware analysis report

Static analysis result for SHA-256 04cebc6b77f4532d…

MALICIOUS

PDF

40.7 KB Authoring application: Mobipocket Creator
MD5: 11f99eff163608a45d58d62ef774ffca SHA-1: 5918847b3097b97534ab13dc77cf0b9d5bd62c46 SHA-256: 04cebc6b77f4532d154b5a2a42c7a9376b7ea48d6f45b33f7c2026f8db5c12d0
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded URLs pointing to other PDF files, a technique often used for SEO spam or to distribute malicious content. ClamAV and ML classifiers also identified this file as malicious, specifically flagging it as phishing-related. The embedded URLs are the primary IOCs, suggesting a link farm or content distribution network.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://dippindogs.org/uploads/1/3/0/4/130488736/suxiguwede-zitotiwe-duxaxagizojavib-gafuwuxoxeru.pdf
    • http://browngreasefuel.com/uploads/1/3/0/6/130604637/3084178e.pdf
    • https://rubenomazaji.weebly.com/uploads/1/3/0/6/130604229/e3ce584.pdf
    • http://tamaraberkeley.com/uploads/1/3/0/3/130323268/7528659.pdf
    • http://fupixoz.instalm.com/uploads/2020/01/27/tovufimujubekabom.pdf
    • http://arenatap.com/uploads/2020/01/29/9311253.pdf
    • http://carlamaebailey.com/uploads/1/3/0/5/130588221/sedawizara_geven.pdf
    • http://concertsbythecreek.com/uploads/1/3/0/3/130323253/vebegidoj.pdf
    • https://nugorovewu.weebly.com/uploads/1/3/0/6/130605204/0e4e1a.pdf
    • http://newmarlboroughfiber.org/uploads/1/3/0/6/130639259/losebadub-genoz-texodoxegod.pdf
    • http://havemeyerhomies.com/uploads/1/3/0/3/130379757/3003478.pdf
    • http://vibramhk100.com/uploads/1/3/0/3/130324236/3145380.pdf
    • http://amybournephotography.com/uploads/1/3/0/3/130313453/zawuzeke.pdf
    • http://safedrivingschool.net/uploads/1/3/0/6/130639121/xodiponakibameget.pdf
    • http://miaburundi.com/uploads/1/3/0/3/130323998/nijegawu-wuzixujisub-xodiwomavokuw-rewesev.pdf
    • http://antoniacundy.com/uploads/1/3/0/6/130603903/jagerasilaposalo.pdf
    • http://charbrinson.com/uploads/1/3/0/6/130621178/dfca49a.pdf
    • https://lubukejizix.weebly.com/uploads/1/3/0/5/130590082/jikopelafetugudaja.pdf
    • http://teleboost.online/uploads/2020/01/28/lapufuvakapogolu.pdf
    • http://ecpn.su/uploads/2020/01/29/3392293.pdf
    • http://fencingaberdeen.com/uploads/1/3/0/5/130550890/febipigunevebotip.pdf
    • http://sanibelcondovacations.com/uploads/1/3/0/5/130551191/5850294.pdf
    • http://enjoni-cafe.com/uploads/1/3/0/6/130621250/5e7e447a25d5dd.pdf
    • https://xaluligazilegos.weebly.com/uploads/1/3/0/5/130543568/wiwogifabu-mumimaweva-gujeguxexoxunes.pdf
    • http://cliftontaxicabs.com/uploads/1/3/0/6/130639236/130639236.html#euphemism+worksheets+for+grade+6+pdf

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001742.bin
05ad1e01aeeb5e56d80b1aad903218ea0b7578dda4b38bbfc17eb9560fb3c754		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1742 7852 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.