Malicious PDF — malware analysis report

Static analysis result for SHA-256 186cca4f37215ff3…

MALICIOUS

PDF

126.2 KB Authoring application: PDFedit
MD5: 279837b5d36d1a1f9867d5d6b6b7110f SHA-1: 4fcd0ef09ad68e4787ae449d0e055f0a38a65e36 SHA-256: 186cca4f37215ff303776e50a04f190c8b4301398380fbcc87148c10aa7b4ab5
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded URLs pointing to external PDF files, as indicated by the PDF_SEO_LINK_FARM heuristic. This suggests a phishing or SEO spam campaign designed to drive traffic to malicious or misleading content. The ML classifier and ClamAV detection further support its malicious nature, flagging it as phishing-related.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://avendoxi5.icu/uploads/2020/01/29/ada725f5a5d12.pdf
    • http://weddingproct.com/uploads/1/3/0/4/130483710/mutiwalap.pdf
    • http://dedietrich-outlet.ru/uploads/2020/01/27/f35ff8aa43b0de.pdf
    • http://claremichelin.com/uploads/1/3/0/2/130288630/c1b37a3.pdf
    • http://buwevosa.remont136.ru/uploads/2020/01/29/xetegegiperozujasoz.pdf
    • https://ximopagokigi.weebly.com/uploads/1/3/0/5/130551019/f65d043a.pdf
    • http://zudeveje.eshorttech.com/uploads/2020/01/27/mariniv.pdf
    • http://moxaxev.militariorgucoz.ru/uploads/2020/01/28/pirijazuwogofo-buzojuwa-fivozuvujapuxu.pdf
    • http://treehousebellaire.org/uploads/1/3/0/6/130621131/908c4c26f03e7.pdf
    • http://pexezi.promyvkapto.ru/uploads/2020/01/29/xepofemako.pdf
    • http://imawareness.ru/uploads/2020/01/28/bozekikiv-xusumuzamewevu.pdf
    • http://insightin2music.com/uploads/1/3/0/2/130289173/1143364.pdf
    • http://telukaz.travelsam.ru/uploads/2020/01/28/wotisarixiradig_bifeliwitawev_katugofafilo_delezow.pdf
    • https://jikoxumuf.weebly.com/uploads/1/3/0/6/130604042/gojesizevaxuma.pdf
    • http://kpbulgakovo.ru/uploads/2020/01/28/zimanuwopibukozoge.pdf
    • http://xanadu.gallery/uploads/1/3/0/6/130620694/130620694.html#autosar+arxml+template
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License
    • http://www.adobe.com/).Noto
    • http://www.google.com/get/noto/http://www.adobe.com/type/This
    • http://scripts.sil.org/OFLNoto

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001038.bin
334405992e7fd16c8d3b26211400362c3deb36cb124ffaa2b39a9a348456c4c9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1038 8396 bytes
font_01_sfnt_off000099d6.bin
2f79ba52acca039e5c354f09c372eb8b3e5c303dfc88b98fa2ec462876c681ba		 pdf-font-stream PDF embedded font (sfnt) at offset 0x99D6 16160 bytes
font_02_sfnt_off0000b786.bin
bf119f8763a74a6f7c8d08197468d1e1715f2160ff165a6d441c04f40664e59f		 pdf-font-stream PDF embedded font (sfnt) at offset 0xB786 91836 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.