Malicious PDF — malware analysis report

Static analysis result for SHA-256 09f32e5f5ce60a10…

MALICIOUS

PDF

42.1 KB Authoring application: Soda PDF
MD5: 27a6722c911d963d85ec21e00b439378 SHA-1: c2198097795dcd9054084b2ecae09302bb2fed23 SHA-256: 09f32e5f5ce60a1005bc3aabcdf4abea3c9e7c3e15bb34d9f545b8e1cd3cffc9
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded links to external PDF files hosted on various domains, as indicated by the PDF_SEO_LINK_FARM heuristic. The ML classifier and ClamAV also flagged this file as malicious, with ClamAV identifying it as Pdf.Phishing.TtraffRobotInstall-7605656-0. The embedded URLs suggest a phishing or content distribution scheme, potentially aiming to redirect users to malicious sites or download further payloads.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://helpsinstagramsupport.com/uploads/2020/01/27/ee5e60da1da3f.pdf
    • http://tensleepseniorcenter.com/uploads/1/3/0/5/130551362/12a4032.pdf
    • http://nickgiamarino.com/uploads/1/3/0/3/130379074/lanezutiwu_vowaf_botabikonanama.pdf
    • http://mydigibong.com/uploads/1/3/0/3/130323319/2135908.pdf
    • http://livingnightmarestv.com/uploads/1/3/0/3/130323151/dd88435.pdf
    • http://lenevidox.iholpworld.com/uploads/2020/01/28/bapumi.pdf
    • http://rivervalleyclinicpc.com/uploads/1/3/0/6/130603690/kiput_niniros_fejoku.pdf
    • http://wael.tech/uploads/2020/01/28/9117112.pdf
    • http://dishingitupgame.net/uploads/1/3/0/5/130538831/fijevovewupir_nizobozamesew.pdf
    • http://xovegadawu.101doggy.com/uploads/2020/01/28/bejupugesotexo-kazivasuxu-reluji-sajinapox.pdf
    • http://lomilasig.tathydro.ru/uploads/2020/01/27/8495491.pdf
    • http://warrenbaker.org/uploads/1/3/0/6/130604188/b3a903ead7a65a.pdf
    • http://blockchainbetterbusiness.com/uploads/1/3/0/4/130478314/movijunoxafef.pdf
    • http://ebdoproperties.com/uploads/1/3/0/6/130621345/xitumo-wupagikatu-xamewupupozoson-baxewexoziner.pdf
    • https://xulepibulijaze.weebly.com/uploads/1/3/0/5/130543976/4568053.pdf
    • http://wainuiponyclub.org/uploads/1/3/0/3/130379769/vimuguzu.pdf
    • https://sewigupos.weebly.com/uploads/1/3/0/6/130604232/losos.pdf
    • http://shopcenter8.fun/uploads/2020/01/29/sifevibud.pdf
    • https://tovikevaxi.weebly.com/uploads/1/3/0/2/130272086/fonefexogopalipixisu.pdf
    • https://lozakuga.weebly.com/uploads/1/3/0/2/130287500/tunux-paxidatuvapizo.pdf
    • http://kinsleyslime.com/uploads/1/3/0/6/130621020/0292a0a6ea0.pdf
    • https://sofetifimekeva.weebly.com/uploads/1/3/0/5/130590383/39bcc1a3.pdf
    • http://ded.office-msk.ru/uploads/2020/01/27/gasodako.pdf
    • http://us.momotombochocolatefactory.com/uploads/1/3/0/6/130621013/130621013.html#excel+vba+convert+multiple+sheets+to+pdf

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000174f.bin
b69c6ede7d1c33eaad81a5512f3f6d092e980f400b1db785ce9383b3933cb3cd		 pdf-font-stream PDF embedded font (sfnt) at offset 0x174F 8492 bytes
font_01_sfnt_off00006974.bin
83459e82cebe561b9e65dda6a09953c9e35f75e5df0fa62a624e1833cc5b8086		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6974 1708 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.