Malicious PDF — malware analysis report

Static analysis result for SHA-256 0dc9e2e86961c7a4…

MALICIOUS

PDF

60.9 KB Authoring application: PDFBox First seen: 2021-05-29
MD5: 2b17b167c844334fe90f33929010ad8d SHA-1: 351c2cade6d3db55cc68d011deab4a8f188df46a SHA-256: 0dc9e2e86961c7a4e6aac06c2fb12a1ff420c8546e1c143a4ab0c7ab509d4764
172 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded links pointing to external PDF files hosted on various domains, indicating a link farm or redirection scheme. The presence of an IP address in a URI and the ML classifier's high confidence score suggest malicious intent. The ClamAV detection of 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports this, pointing towards a phishing or traffic redirection campaign.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Clickable URI points to raw IP address medium PDF_URI_IP_LITERAL
    PDF contains a clickable HTTP(S) action whose host is a literal IPv4 address. Legitimate documents normally link to named domains; raw-IP destinations are common in disposable phishing and malware-delivery infrastructure.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://kufakowawaxug.weebly.com/uploads/1/3/0/5/130544072/7515741.pdf In PDF document text
    • http://taxuw.etalonclinica.ru/uploads/2020/01/28/fakumiled_lotugukukuveze_wubufov_xekomubew.pdfIn PDF document text
    • https://zuzeserotuxutur.weebly.com/uploads/1/3/0/5/130588370/jixonipowo.pdfIn PDF document text
    • http://kov.mariocoin.ru/uploads/2020/01/28/0aa502b0c28.pdfIn PDF document text
    • http://95.217.124.64:80/uploads/2020/01/27/bolojo_zonajunalaviko_wajonumufunu.pdfPDF link annotation
    • http://mopurefi.tayadsy.tech/uploads/2020/01/27/golutapikotij_dodawirunesa_rawogomamage_gijabazuwejak.pdfIn PDF document text
    • http://walevif.lafethome.ru/uploads/2020/01/27/1719630.pdfIn PDF document text
    • http://audiostart43.icu/uploads/2020/01/28/siwefudutuko.pdfIn PDF document text
    • http://kol.candidaturaomarmolina.com/uploads/2020/01/27/be2669f8a9.pdfIn PDF document text
    • http://bupo.opr0.icu/uploads/2020/01/28/1073f6f.pdfIn PDF document text
    • https://xavedoso.weebly.com/uploads/1/3/0/5/130540178/2571cd92.pdfIn PDF document text
    • https://faxokefovidimu.weebly.com/uploads/1/3/0/4/130476310/beretaxoweviki.pdfIn PDF document text
    • https://tapebugu.weebly.com/uploads/1/3/0/5/130550936/kijubavo.pdfIn PDF document text
    • http://jizevi.blamecharlie.com/uploads/2020/01/27/pifeguga_xoguzabopiluw_zorirov.pdfIn PDF document text
    • http://kepapeduf.ars-shipping.com/uploads/2020/01/28/4a6696cf05cf0b.pdfIn PDF document text
    • http://wub.mozgach.ru/uploads/2020/01/27/kozutexojewanojabo.pdfIn PDF document text
    • http://feni.gosuslugi-moskva.ru/uploads/2020/01/27/868321.pdfIn PDF document text
    • http://kuvu.firstcommonsense.com/uploads/2020/01/28/9005673.pdfIn PDF document text
    • http://mesus.sianie72.ru/uploads/2020/01/27/xitusamezemojas-kimek-lekibup-ruwuro.pdfIn PDF document text
    • https://gofelitoboza.weebly.com/uploads/1/3/0/2/130270863/bolokogokanegoliz.pdfIn PDF document text
    • http://jare.eovma.fun/uploads/2020/01/27/6384683c.pdfIn PDF document text
    • https://xodufokuzot.weebly.com/uploads/1/3/0/2/130289480/130289480.html#carolina+hurricanes+playoff+record+2019In PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://fedoraproject.org/wiki/Licensing/LiberationFontLicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000017b8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x17B8 9456 bytes
SHA-256: ce88f0422911cfbf89238d8a60ab196035ca7a137d0ff2e012f3c2df10d1ac3b
font_01_sfnt_off0000b34b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xB34B 2732 bytes
SHA-256: 7863b829de04ea8b7f5be4d5dae43fa62182e7611f0c3a300d10b316d27db496

Open this report in the interactive analyzer, or submit your own file for analysis.