Malicious PDF — malware analysis report

Static analysis result for SHA-256 2b5b89be9a639c4e…

MALICIOUS

PDF

31.1 KB Authoring application: ImageMagick
MD5: acf08e6e37a71167c9fa23a243ba9d43 SHA-1: 5b8dcc7749ea1f7203399ae0fccf7dc602a7c6e8 SHA-256: 2b5b89be9a639c4e8e99b89c063defa38ee2cf20cbddf192b4f6bc1a0de5071d
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF contains a large number of embedded URLs pointing to external PDF files, a technique often used for SEO spam or to redirect users to malicious content. The ClamAV detection and ML classifier strongly indicate malicious intent. The primary attack pattern involves directing users to a link farm of potentially malicious or spam content.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ddsdelightsonline.com/uploads/1/3/0/4/130435726/63afb6d3b9a6.pdf
    • http://ccinus.com/uploads/1/3/0/2/130287536/2938986.pdf
    • http://risixulej.pulkovo3.info/uploads/2020/01/28/kijifazuj.pdf
    • https://wezawirikal.weebly.com/uploads/1/3/0/4/130483213/desekufafuzek-miwerox-xiwibaludafuxix-tivodeneropoje.pdf
    • http://designsbygrammy.net/uploads/1/3/0/6/130620700/xabulajabi-xiwewow-jezebepududupo-kugilekuwume.pdf
    • http://fuck4me.top/uploads/2020/01/27/paxazuge_lotoni_kulaf_butixasaril.pdf
    • http://tozoz.pweuxk.xyz/uploads/2020/01/29/jopatetimasab_bevisoj_wurasuj.pdf
    • http://artspark.com/uploads/1/3/0/4/130488328/6192552.pdf
    • http://piserog.cesare.su/uploads/2020/01/28/38867f2.pdf
    • http://nathanlyonn.weebly.com/uploads/1/3/0/6/130639205/d7d12.pdf
    • http://womuwi.achdziewczyny.site/uploads/2020/01/27/mibibosijivutod_lular_jumolofekiwa.pdf
    • http://ral.pritrethriftshopinc.org/uploads/2020/01/27/kosojuziwaxirefut.pdf
    • https://jasasilevi.weebly.com/uploads/1/3/0/4/130476555/86a42.pdf
    • http://xuximef.nevaergomebel.ru/uploads/2020/01/29/3887425.pdf
    • http://strongrootsfoundationmn.org/uploads/1/3/0/3/130323588/1577489.pdf
    • http://jagigogiw.maru.su/uploads/2020/01/28/xefetumesatuw_buvazavugeviv_tifoxererumadif.pdf
    • http://vak.kaluga-land.ru/uploads/2020/01/28/wisalarugug-vediramogu-xabuwupu-ximovamit.pdf
    • http://luxstal.com/uploads/2020/01/27/f26e309bb80.pdf
    • http://chewoncakes.com/uploads/1/3/0/2/130289515/130289515.html#biology+kingdom+classification+worksheet+answers

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000154e.bin
9a974edcde12271d89a5e547c7eb86915d789fc6cdfea409f9541b0024655416		 pdf-font-stream PDF embedded font (sfnt) at offset 0x154E 7076 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.