Malicious PDF — malware analysis report

Static analysis result for SHA-256 26d617867d137115…

MALICIOUS

PDF

36.5 KB Authoring application: Soda PDF
MD5: 2e8ec758a52ccc8a3fb2e38156b2a762 SHA-1: cacab3201b8a95db892e5348171fdbc9a3a24383 SHA-256: 26d617867d137115636a8db40d78c3845c0c1ef3f06deb2855ea5b7925953668
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of external links, as indicated by the PDF_SEO_LINK_FARM heuristic. The ClamAV detection and ML classifier also flag this file as malicious, specifically as a phishing attempt. The embedded URLs likely lead to further malicious content or phishing pages.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://sicrediatualiza.store/uploads/2020/01/29/a1b1f39a.pdf
    • http://rijaku.hidrografics.com/uploads/2020/01/28/nidipatajugugux.pdf
    • http://palmcoastflautorepair.com/uploads/1/3/0/2/130271214/togenekofujomiriwod.pdf
    • http://claverackisworking.com/uploads/1/3/0/5/130588168/jigafoxukegob_kiroxubape.pdf
    • http://kesundesign.com/uploads/1/3/0/2/130289431/6511649.pdf
    • http://foilingkiteboard.com/uploads/1/3/0/2/130274343/c20f97d1f09e443.pdf
    • http://ustroymsk.ru/uploads/2020/01/27/7996267.pdf
    • https://melafibavufus.weebly.com/uploads/1/3/0/5/130541004/8384973.pdf
    • http://900cahuenga.com/uploads/1/3/0/2/130287289/0b9a25599f0.pdf
    • http://tinex.hangxao.com/uploads/2020/01/28/ranumetiguzezexuza.pdf
    • http://scoutx.us/uploads/1/3/0/4/130483989/982784.pdf
    • http://duki.icu/uploads/2020/01/27/7025860.pdf
    • https://noxixukatusupud.weebly.com/uploads/1/3/0/5/130551363/dusorerimerumusu.pdf
    • http://tenur.zorfa.icu/uploads/2020/01/28/zuxefujeko.pdf
    • http://metuljcki.com/uploads/1/3/0/5/130588721/09320e6.pdf
    • http://riza.mupoisk.info/uploads/2020/01/29/xuduxijozek-domodudigodugev-sozatirafem.pdf
    • http://suv.neupustishans.ru/uploads/2020/01/28/ranonutol_jituzalu.pdf
    • http://ktrpo.com/uploads/1/3/0/2/130288642/7e2e12efd5d0fc.pdf
    • https://bojifima.weebly.com/uploads/1/3/0/5/130543874/miwejava.pdf
    • https://fademudom.weebly.com/uploads/1/3/0/6/130604902/gobukixidolili-sudazin-likid.pdf
    • http://somersetfoodtrail.org/uploads/1/3/0/4/130491356/130491356.html#english+conversation+worksheets+pdf
    • https://fademudom.weebly.com/uploads/1/3/0/6/130604902/gobukixidolil

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000157c.bin
7b1ec91b4ac2806792338eb23a1500de959fcfa9ac72b530e2d801953fa32ac2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x157C 7412 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.