Malicious PDF — malware analysis report

Static analysis result for SHA-256 10188fd67e2ad22c…

MALICIOUS

PDF

36.8 KB Authoring application: Poppler-utils
MD5: 0f18e2e471e2920e38abc9e17cc646d6 SHA-1: 91200ac10b77fe941db30c48763f7c7d425810f6 SHA-256: 10188fd67e2ad22c1fc9b105b477f86de64b698c5f1a351c62b0a5153d48a648
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded URLs pointing to external PDF files, a technique often used for SEO spam or to distribute further malicious content. ClamAV detected this as 'Pdf.Phishing.TtraffRobotInstall-7605656-0', indicating a phishing or traffic redirection scheme. The ML classifier also strongly flagged this PDF as malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://daguvazuzog.weebly.com/uploads/1/3/0/3/130313082/kabox-kuzugojadejamaj-suxamolopowab.pdf
    • https://runezoxe.weebly.com/uploads/1/3/0/5/130550706/kiwiwifuzidomupipoj.pdf
    • http://web-bonus.xyz/uploads/2020/01/28/8f172377.pdf
    • http://jajigu.hospitalnaluri.com/uploads/2020/01/27/babunif.pdf
    • https://wosapola.weebly.com/uploads/1/3/0/3/130313247/2522778.pdf
    • https://lodafudibo.weebly.com/uploads/1/3/0/5/130543787/ce9e7.pdf
    • https://xeruguwutagidob.weebly.com/uploads/1/3/0/5/130544067/6066103.pdf
    • http://ruvepal.audiostart56.icu/uploads/2020/01/29/dodamuvavomezipemot.pdf
    • http://laama.ru/uploads/2020/01/28/kipel_gokuwote.pdf
    • https://rovupewiloj.weebly.com/uploads/1/3/0/6/130605349/dipore.pdf
    • https://putolibavusok.weebly.com/uploads/1/3/0/6/130604153/mojifesazibanedot.pdf
    • https://fozemanesafire.weebly.com/uploads/1/3/0/5/130546432/9242220.pdf
    • http://poguzek.rentkazan.com/uploads/2020/01/29/832712.pdf
    • http://mimebulo.vernovelas.org/uploads/2020/01/28/5979574.pdf
    • http://gajudude.baksmans.club/uploads/2020/01/28/fotalame.pdf
    • https://kagumolat.weebly.com/uploads/1/3/0/2/130289466/67f01151d2ed.pdf
    • https://morarafaf.weebly.com/uploads/1/3/0/5/130590224/130590224.html#roles+and+responsibilities+of+clinical+research+associate+as+per+ich+gcp

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001482.bin
406537cdd306d3009b28d42fd3826be239d191bb183f7a606c1826358895f74f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1482 7992 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.