Malicious PDF — malware analysis report

Static analysis result for SHA-256 0f688ee2708ef17e…

MALICIOUS

PDF

41.2 KB Authoring application: Adobe PDF Library 9.0 First seen: 2020-12-25
MD5: 134554b279dfb6b16492c8cf465950c8 SHA-1: 0ad6c1564aff7e18cb0241c77d346165b2a177e2 SHA-256: 0f688ee2708ef17edf052d157cb424544479342f883f3b07e174a2a7b192a41b
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1105 Ingress Tool Transfer

This PDF file contains a large number of embedded URLs pointing to other PDF files hosted on various domains. The heuristic 'PDF_SEO_LINK_FARM' and the sheer volume of external links suggest a malicious intent, possibly for SEO manipulation or to distribute further malware. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports its malicious nature.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://sunnystats.com/uploads/1/3/0/5/130539757/poxikexerekezez.pdf In PDF document text
    • http://productionriggingdepartment.com/uploads/1/3/0/4/130436017/d66cd389e38c84b.pdfIn PDF document text
    • https://ritogawigulaxow.weebly.com/uploads/1/3/0/3/130323216/27650dae0c.pdfIn PDF document text
    • https://rimatujenajo.weebly.com/uploads/1/3/0/6/130604933/safexiku.pdfIn PDF document text
    • https://xidobujirol.weebly.com/uploads/1/3/0/4/130436298/gabibufedigituluduro.pdfIn PDF document text
    • http://tryhardkitchen.com/uploads/1/3/0/5/130543084/3a2cac56a.pdfIn PDF document text
    • http://smph.agency/uploads/1/3/0/2/130289387/ragudekapijeliwowuj.pdfIn PDF document text
    • http://doulakaribirthservices.com/uploads/1/3/0/5/130589156/koratonilo_fuvepokokede_venusevevezu_biposilewimo.pdfIn PDF document text
    • http://meridianworldschoollibrary.com/uploads/1/3/0/6/130604604/dageb-netapegubum-nekexi.pdfIn PDF document text
    • http://vope.domgleden-nn.icu/uploads/2020/01/29/7983ae.pdfIn PDF document text
    • https://buxozutewodiw.weebly.com/uploads/1/3/0/5/130590353/bewojutu_mopubadisene.pdfIn PDF document text
    • https://fonamezopev.weebly.com/uploads/1/3/0/4/130483384/4105.pdfIn PDF document text
    • https://rubusaxenijipe.weebly.com/uploads/1/3/0/4/130483303/sikopavonefarurafe.pdfIn PDF document text
    • http://zotakorosi.oftsinwiltit.pro/uploads/2020/01/27/d496b048893ff.pdfIn PDF document text
    • http://stefanovsajt.com/uploads/1/3/0/6/130621654/1425368.pdfIn PDF document text
    • http://cigarclubmodesto.com/uploads/1/3/0/5/130541743/lawifatiretozogum.pdfIn PDF document text
    • http://nanba-ryu.com/uploads/1/3/0/6/130603673/jininufarofivusalome.pdfIn PDF document text
    • http://absystemsllcscam.com/uploads/1/3/0/3/130379151/130379151.html#baldrige+award+criteria+pdfIn PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001575.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1575 8328 bytes
SHA-256: f6e441855e37ff7a795042eed8eee0f97f8ada47fb87a65680f276d92e758c0b

Open this report in the interactive analyzer, or submit your own file for analysis.