Malicious PDF — malware analysis report

Static analysis result for SHA-256 1829e4924fffd95d…

MALICIOUS

PDF

46.9 KB Authoring application: Mobipocket Creator
MD5: c7f2b185560372c480139964ea2e2be1 SHA-1: fc41f55a123e7f4fdd3b5712f088e58dcd77901c SHA-256: 1829e4924fffd95d2328c3f2b4bb9db769b4191757e1957ff69a1c375561a113
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains a mass of external links to other PDF files, as indicated by the PDF_SEO_LINK_FARM heuristic. The ML classifier and ClamAV detection strongly suggest malicious intent, specifically identified as phishing or traffic redirection. The embedded URLs likely serve to distribute malware or lead users to phishing sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://nija.trouversfr.info/uploads/2020/01/29/c6611c2eb3a4e.pdf
    • http://robiskincare.ca/uploads/1/3/0/5/130540661/5561901.pdf
    • http://morgangracejarrett.com/uploads/1/3/0/5/130539458/murugudixeleba.pdf
    • http://sallysfitnessfortress.com/uploads/1/3/0/6/130603982/4811725.pdf
    • http://liamsamolis.com/uploads/1/3/0/2/130272474/kidowogajik-rageluwarorok-jakirozizedeki-woposilux.pdf
    • http://annalyzethat.com/uploads/1/3/0/4/130491319/pubajatimavonelovop.pdf
    • http://bipevoxitu.mnzdrv-biotic.ru/uploads/2020/01/28/rebuzasonagexeroxip.pdf
    • https://xutidororewu.weebly.com/uploads/1/3/0/5/130588434/b2334fccb520140.pdf
    • http://cleverk9sports.com/uploads/1/3/0/6/130605447/5603362.pdf
    • http://numinersfootball.com/uploads/1/3/0/6/130620626/rozusapidu.pdf
    • http://nycartsed.com/uploads/1/3/0/4/130483858/4275926.pdf
    • http://wilsonfarmmurfreesboro.com/uploads/1/3/0/5/130540437/lanemiropo.pdf
    • http://sukinida.diamantevidrosweb.site/uploads/2020/01/28/20fc3543fd55.pdf
    • http://sujitaomgoit.com/uploads/1/3/0/6/130640101/c01051.pdf
    • http://ferma.club/uploads/2020/01/27/d89f81c6.pdf
    • http://madridtherapist.com/uploads/1/3/0/4/130483911/lavumemozixaw_ronezo_pafikogajevixuv_texovajulagid.pdf
    • http://romijaru.ecpn.su/uploads/2020/01/28/gigopovi.pdf
    • http://wafirumude.flooks.ru/uploads/2020/01/27/fulibamo.pdf
    • http://astrologieparis.fr/uploads/1/3/0/2/130289270/130289270.html#surah+yaseen+tilawat+tarjuma+mp3+download
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000174d.bin
6241d828b1e66a24f55c043b725c9b87846240ec1f7f4adedb79a553803c79ec		 pdf-font-stream PDF embedded font (sfnt) at offset 0x174D 9004 bytes
font_01_sfnt_off0000645c.bin
367ba2b7165cdca1c617567e54f35738c0164aa60ce26dbecf97e92dfb2f2ecb		 pdf-font-stream PDF embedded font (sfnt) at offset 0x645C 20292 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.