Malicious PDF — malware analysis report

Static analysis result for SHA-256 29ee548fc86a3e1b…

MALICIOUS

PDF

39.0 KB Authoring application: QPDF
MD5: f8b31c8a6d74264e91b32a98151c7dbc SHA-1: d07d663c015fb08f2a942436586bfb66f157f48b SHA-256: 29ee548fc86a3e1b74badf5e6170740a1f778545c13e96f766493b6f8c363012
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF document contains a link farm designed to lure users to download further malicious content, as indicated by the 'PDF_SEO_LINK_FARM' heuristic. The embedded URLs and the ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' strongly suggest a phishing or malware distribution campaign. The document body text, though partially corrupted, mentions 'Kleppner and kolenkow' and a warning about an outdated Internet Explorer version, reinforcing the phishing pretext.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://nolo.satellit55.ru/uploads/2020/01/27/kimekebuke.pdf
    • http://zevigo.eccex.fun/uploads/2020/01/28/jijevexov_vewujuzibotarip.pdf
    • http://jurepoju.1-gc.net/uploads/2020/01/27/75c31d665aea.pdf
    • http://tirazoxi.eventrabbelac.pro/uploads/2020/01/27/nekalarusi.pdf
    • http://roruwuwel.driverok.info/uploads/2020/01/27/6577386.pdf
    • http://nixog.profial-ug.ru/uploads/2020/01/28/lijakamoj.pdf
    • http://mercertruckaccessories.ca/uploads/1/3/0/6/130604616/130604616.html#kleppner+and+kolenkow

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000010b9.bin
a54dd9e3df0e3d1fdf02e090c5923eb89cc9d9b1c5b6572422135d11c4f52c34		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10B9 8304 bytes
font_01_sfnt_off000050f9.bin
5d7ebd720715cd86529581f1d40cc643f68465477bd430d4be5ff736bc95f798		 pdf-font-stream PDF embedded font (sfnt) at offset 0x50F9 16268 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.