Malicious PDF — malware analysis report

Static analysis result for SHA-256 24b5788f0f2cd404…

MALICIOUS

PDF

50.8 KB Authoring application: SWFTools
MD5: 204b99b9615aebba80eaf1a4eeffbad8 SHA-1: 4f8da9162502f8cda66e441548d124190909e38d SHA-256: 24b5788f0f2cd4042564ec79bda1b97b5e472b8b0b794ca028704f57dac04717
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

This PDF file was flagged by multiple heuristics, including ClamAV and an ML classifier, as malicious phishing content. The PDF contains a large number of embedded URLs pointing to external PDF files hosted on various suspicious domains. The primary heuristic indicates a 'PDF_SEO_LINK_FARM' attack pattern, suggesting the document is designed to drive traffic to these linked PDFs, likely for phishing or malware distribution. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://burgangt.com/uploads/1/3/0/6/130639115/nawuratofugipata.pdf
    • http://nar.myopros.tech/uploads/2020/01/28/7290485.pdf
    • http://sigom.aewjasw.icu/uploads/2020/01/28/vuxabizalamoka.pdf
    • http://jodovox.mstaml-tb.icu/uploads/2020/01/28/wazijofefowinu.pdf
    • http://dwoslab.com/uploads/1/3/0/5/130539102/wivokepogejepu.pdf
    • http://bitemenewengland.com/uploads/1/3/0/3/130323894/be741fa7.pdf
    • http://pcotechnologies.com/uploads/1/3/0/3/130379272/sovududimori_vuzavipeje_risawi.pdf
    • http://translatorquote.com/uploads/1/3/0/8/130814601/eecafd85cd5db7.pdf
    • http://pagesustainability.com/uploads/1/3/0/7/130776486/6703053.pdf
    • http://clutteroftheday.com/uploads/1/3/0/6/130621082/7006039.pdf
    • http://andyharrisasblacksheep.com/uploads/1/3/0/3/130312916/mupaxifa.pdf
    • http://the-easy.life/uploads/1/3/0/3/130379818/zevetemugo.pdf
    • http://cityonloc.com/uploads/1/3/0/6/130640179/130640179.html#chilling+adventures+of+sabrina+comic+book

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001342.bin
0bc9437dee6a943bc3c61a84750c1efca46f2e7506f3240c6f5693922d3bd1bc		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1342 8400 bytes
font_01_sfnt_off0000810b.bin
b3affdfdfee497c2d3230853582529cf395d265bfdbb8cde7d84ae9c33602211		 pdf-font-stream PDF embedded font (sfnt) at offset 0x810B 16036 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.