PDF malware analysis — malicious · 06a7cd238671131b

MALICIOUS

PDF

46.8 KB Authoring application: Solid Converter PDF

MD5: b1105aa86cf477643e32163a354e7ad7 SHA-1: 0e3f7a8f6996b8e9fb10651b5cd688d7ad35460a SHA-256: 06a7cd238671131b9e6cac8ecc7f2e7aa4daf56e4dbec167a9cf34e130bc0d5c

152 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded URLs pointing to external PDF files, a technique often used for SEO spam or to redirect users to malicious content. ClamAV identified this as 'Pdf.Phishing.TtraffRobotInstall-7605656-0', and a machine learning classifier also flagged it as malicious. The embedded URLs are the primary indicators of malicious activity.

Machine Learning

Nyx PDF Classifier malicious score 0.9999

Heuristics 3

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://vimemese.vipiski-besplatno23.icu/uploads/2020/01/27/jominef.pdf
- http://tumi.danielfache.com/uploads/2020/01/27/bivapa-tatevat.pdf
- http://cavumcloud.com/uploads/1/3/0/5/130588998/wajomegidigoratip.pdf
- http://alicevonlindenau.com/uploads/1/3/0/2/130272231/8630d82.pdf
- http://bonusata.goodzinfo.net/uploads/2020/01/29/bekejotidililuka.pdf
- http://nutritionwithnahla.net/uploads/1/3/0/6/130639155/de43e438c34.pdf
- http://natashafine.com/uploads/1/3/0/6/130621195/8738503.pdf
- http://missaldrichenglish10.weebly.com/uploads/1/3/0/6/130639763/71bfc9.pdf
- http://christine-carney.com/uploads/1/3/0/5/130539059/3900760.pdf
- http://thriftstorehemet.com/uploads/1/3/0/2/130288410/cdd8a9d.pdf
- http://rixo.sochi-ses.ru/uploads/2020/01/28/mobebixo.pdf
- http://myfloridaec.org/uploads/1/3/0/5/130588289/726cea35.pdf
- http://kib.x-qual.com/uploads/2020/01/28/bosapeledorokud.pdf
- http://lisathomascounselingcorner.com/uploads/1/3/0/2/130291485/d6903c.pdf
- http://roguraxu.event-essence.com/uploads/2020/01/28/vovopaxanoko_buwexad.pdf
- https://nadobeja.weebly.com/uploads/1/3/0/3/130379548/31701.pdf
- http://tatianasy.com/uploads/1/3/0/2/130272847/af344.pdf
- https://bewaxojex.weebly.com/uploads/1/3/0/4/130494478/gujerovajirugevax.pdf
- http://weeblyreviews.org/uploads/1/3/0/2/130291471/2546154.pdf
- http://lekeapena.com/uploads/1/3/0/6/130620746/4242551.pdf
- https://sasurejojutim.weebly.com/uploads/1/3/0/2/130270974/d9cfc.pdf
- https://serafubok.weebly.com/uploads/1/3/0/2/130291365/9820248.pdf
- http://rosshousemuseum.ca/uploads/1/3/0/5/130588248/momolasepolarajiju.pdf
- http://brecht.holyrood-drama.com/uploads/1/3/0/6/130605462/3268341.pdf
- http://foxiru.delodoc.cc/uploads/2020/01/28/f504f0.pdf
- http://colddiamnd.com/uploads/1/3/0/6/130620370/130620370.html#explode+animation+android+example
- http://dejavu.sourceforge.net
- http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00001720.bin` `c28fd0f76a1ec2ffd8092af522f69692d3ccfdd7cf973a5bf027d03234ac286c`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1720	8120 bytes
`font_01_sfnt_off00006eed.bin` `5d7ebd720715cd86529581f1d40cc643f68465477bd430d4be5ff736bc95f798`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6EED	16268 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.