Malicious PDF — malware analysis report

Static analysis result for SHA-256 2d884dedb9383a20…

MALICIOUS

PDF

38.7 KB Authoring application: Pdftk
MD5: 9a189b2f1e6f0d348525fb1d17eed8fb SHA-1: 8160c527c24d5a61ff6e5c8359a029a2e91ab3bc SHA-256: 2d884dedb9383a20afcdfea058f6341707665f4dca89aada05221e2328eaf7bf
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file was detected as malicious by ClamAV and an ML classifier. The heuristic 'PDF_SEO_LINK_FARM' indicates the presence of numerous external links, suggesting a phishing or traffic-driving campaign. The embedded URLs, such as http://womenrockjewelry.com/uploads/1/3/0/3/130313390/960bc70e2a4.pdf, are likely part of this scheme. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://womenrockjewelry.com/uploads/1/3/0/3/130313390/960bc70e2a4.pdf
    • http://fivipaki.private-girls.club/uploads/2020/01/29/80ad62d85595.pdf
    • http://admgems.com/uploads/1/3/0/5/130590008/todipabunuzewak.pdf
    • https://daxivofe.weebly.com/uploads/1/3/0/4/130488304/3214443.pdf
    • http://ceramikerie.de/uploads/1/3/0/5/130539702/9162847.pdf
    • http://rek.se/uploads/1/3/0/3/130313249/fujonuxofaz.pdf
    • http://thesupremeperformanceacademy.com/uploads/1/3/0/5/130545827/9680fa292.pdf
    • http://mocamarketing.com/uploads/1/3/0/4/130483633/supifadutanumosexoji.pdf
    • http://carolinevanthoff.com/uploads/1/3/0/6/130604144/fozezujasu-dupuvep-xigiwewokuron-nebisoged.pdf
    • https://tiwumepafekimi.weebly.com/uploads/1/3/0/5/130588417/lakad-xobibivorulu-fexolo.pdf
    • http://ddsdelightsonline.com/uploads/1/3/0/6/130621841/zukasatokil-xagejomivomov-tubiradudiluvik-mafan.pdf
    • http://athleticpromoters.com/uploads/1/3/0/2/130288402/7595884.pdf
    • http://cityonloc.com/uploads/1/3/0/4/130483512/130483512.html#formato+de+certificado+medico+de+salud+peru

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001394.bin
1a3813ccf128c8f12ba1dc09b5ffd68597fa0801d92e53a3c9e5aca6cf162808		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1394 8664 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.