Malicious PDF — malware analysis report

Static analysis result for SHA-256 166b86e6829be6a9…

MALICIOUS

PDF

47.1 KB Authoring application: SWFTools
MD5: f6b993a2a20be12134ffdb9f0a64d500 SHA-1: 2948337cc71ccc7429a2cdeb2899f4fa36db293f SHA-256: 166b86e6829be6a9032c5e42a22d42b7ba8469165f000b4cb1b311ff37dc35db
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. ClamAV and an ML classifier also flagged this file as malicious, with ClamAV specifically identifying it as 'Pdf.Phishing.TtraffRobotInstall-7605656-0'. The embedded URLs likely lead to further malicious content or phishing sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://1957rams.org/uploads/1/3/0/5/130589163/jimewoxexarul_roneginepil.pdf
    • http://lightfastdesign.com/uploads/1/3/0/3/130323707/99af671.pdf
    • https://daxivofe.weebly.com/uploads/1/3/0/4/130488304/5952169.pdf
    • http://mrsdawson-classroom.com/uploads/1/3/0/2/130274305/fizedotovokajunolof.pdf
    • http://resurfacetechnology.com/uploads/1/3/0/2/130287527/3211232.pdf
    • https://duzufewobozoxu.weebly.com/uploads/1/3/0/3/130379427/tirudov.pdf
    • http://obituar.org/uploads/1/3/0/3/130379485/e2a9aaba15cfb56.pdf
    • http://gir.sverhpotok.com/uploads/2020/01/28/muviwuto.pdf
    • http://profmediarus.ru/uploads/2020/01/29/96045a.pdf
    • http://monuem.org/uploads/1/3/0/4/130491319/dokarozutasefuro.pdf
    • http://tireshopphoenix.pro/uploads/1/3/0/5/130551248/7144481.pdf
    • https://zapekewagavupo.weebly.com/uploads/1/3/0/3/130313218/fosobapiziw-sufavofesapa-noretowegomejis.pdf
    • http://misbailes.com/uploads/1/3/0/4/130489228/130489228.html#abcd+2+full+movie++720p+hd
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License
    • https://fedoraproject.org/wiki/Licensing/LiberationFontLicense

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001398.bin
3082a904e6a2a28efe8da4520e58593f58d46560b2ed83b67be75cdc5247e991		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1398 8980 bytes
font_01_sfnt_off000067bf.bin
1449a6a133fbba3f85fccdc8a34aa05b08b4f17ac75c7c2a9e14bb3c9634516b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x67BF 16060 bytes
font_02_sfnt_off00007c1c.bin
bafd5aaf9c4ebc64667547dc5098eb02cc1bbb84856feca235901f5c51b421e7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7C1C 2864 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.