Malicious PDF — malware analysis report

Static analysis result for SHA-256 121b1268a1d02839…

MALICIOUS

PDF

73.7 KB Authoring application: SWFTools
MD5: d358e22ad6c882905cbc28c82c8f4e8a SHA-1: 2385cbbe560d88a098fe91429aea6c271c2dda29 SHA-256: 121b1268a1d028394a009a56b0286094325efa009e5b408d9579fcd8470dc541
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file contains a large number of embedded URLs, identified as a link farm, which is a common technique for distributing malicious content or conducting phishing attacks. The ClamAV detection and ML classifier further support its malicious nature, indicating it is likely a phishing or malware distribution lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9974

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://yamayogacollective.com/uploads/1/3/0/7/130775527/5762962.pdf
    • http://oldnewborrowed.com/uploads/1/3/0/8/130814803/fevuwur_kerafuremo_mowugexeposo_rubofuredana.pdf
    • http://rclfitness.com/uploads/1/3/0/7/130738918/f3d1ffbf0.pdf
    • http://boisdarcreations.com/uploads/1/3/0/6/130621477/1810840.pdf
    • http://bowls.ws/uploads/1/3/0/2/130291492/sedebekalovilo.pdf
    • http://imagecathedral.net/uploads/1/3/0/5/130588384/pomozul.pdf
    • http://reneteassuredtitleagency.us/uploads/1/3/0/5/130547486/87c2c2360cc3.pdf
    • http://hostmaster.production37.com/uploads/1/3/0/8/130874540/edb1b.pdf
    • http://mta-sts.mx.webapocaninetraining.com/uploads/1/3/0/3/130323571/e882727e.pdf
    • http://leadershipcv.com/uploads/1/3/0/2/130287503/53422f62.pdf
    • http://333-tools.com/uploads/1/3/0/7/130775784/51596432.pdf
    • http://datahub.sytechsolutions.com/uploads/1/3/0/6/130603725/dixarafig_patekaxaj.pdf
    • http://bubbleandmimiltd.com/uploads/1/3/0/7/130776523/7509941.pdf
    • http://livinghubs.com/uploads/1/3/0/4/130435757/5be04827e542e77.pdf
    • http://myhypnoshow.com/uploads/1/3/0/7/130738504/2620755.pdf
    • http://bartolomeilaw.com/uploads/1/3/0/3/130323493/sotujawutebe.pdf
    • http://bcattic.com/uploads/1/3/0/6/130604428/wevixad.pdf
    • http://movotics.com/uploads/1/3/0/3/130313553/853809.pdf
    • http://westboro-apts.ca/uploads/1/3/0/5/130545043/b244c.pdf
    • http://sandrawimbish.org/uploads/1/3/0/6/130604708/waritike.pdf
    • http://beardedbeaverco.com/uploads/1/3/0/3/130313433/2975d36d68f487.pdf
    • http://mercyscleaningservices.com/uploads/1/3/0/3/130323406/tudofilivogur_toniposu_liwalamoxedurof_tiwuxove.pdf
    • http://scrumboards.com/uploads/1/3/0/7/130739158/fomipifoz.pdf
    • http://thehavenresorts.devsite-1.com/uploads/1/3/0/2/130287261/130287261.html#br+a1013+datasheet
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.adobe.com/).Noto
    • http://www.google.com/get/noto/http://www.adobe.com/type/This
    • http://scripts.sil.org/OFLNoto
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License
    • https://savannah.gnu.org/projects/freefont/
    • http://www.gnu.org/licenses/
    • http://www.gnu.org/copyleft/gpl.html
    • https://fedoraproject.org/wiki/Licensing/LiberationFontLicense

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004b23.bin
7d432903cc811cdc4b0d54e8e5ea6b86a28c99099d690be2e613f6383d85933e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4B23 21632 bytes
font_01_sfnt_off00008c81.bin
55e88c4a738ceb8b153bcd8c64e4d226cc02b625f55f13de48c0c926db619d07		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8C81 16440 bytes
font_02_sfnt_off0000a1fa.bin
d576e2173e5bafe917a889f060d97b375f93f6490bf8fd275835fe3c202e68de		 pdf-font-stream PDF embedded font (sfnt) at offset 0xA1FA 6168 bytes
font_03_sfnt_off0000b07c.bin
3b0ba2372aacd7886f396516671973f9ab87012ff2916d534145e23a9b1b0916		 pdf-font-stream PDF embedded font (sfnt) at offset 0xB07C 2760 bytes
font_04_sfnt_off0000bd03.bin
e6db2fabf6d2c2630096eda36e00d160681971adb9ed36d9cbefeeaca70bf511		 pdf-font-stream PDF embedded font (sfnt) at offset 0xBD03 8712 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.