Malicious PDF — malware analysis report

Static analysis result for SHA-256 2da95251de27506f…

MALICIOUS

PDF

45.7 KB Authoring application: PDFBox
MD5: e2d49f6dc7b82d4a4d4e671df73d4f2b SHA-1: c09c8c18f0f30f3f3bb90a3e79ea01680ee1735d SHA-256: 2da95251de27506f4f0a7377cc6deef65f9777d8ba18fc9048bfd74ad1c8ed7e
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file was flagged by ClamAV as Pdf.Phishing.TtraffRobotInstall-7605656-0 and a machine learning classifier. The heuristic PDF_SEO_LINK_FARM indicates the presence of a link farm with 21 external PDF links, the first being http://fuzufomat.planbani.ru/uploads/2020/01/27/kivutaxabavejija.pdf. This suggests the document is designed to redirect users to malicious content, likely for phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://fuzufomat.planbani.ru/uploads/2020/01/27/kivutaxabavejija.pdf
    • http://rigawev.angrybirds.tech/uploads/2020/01/28/7424005.pdf
    • http://jevolexase.knb-fun.fun/uploads/2020/01/27/didudorawafulok.pdf
    • http://jowoxuz.copyrightcontact-1000029438567.com/uploads/2020/01/28/8391518.pdf
    • http://katlegok.com/uploads/1/3/0/2/130289573/bovifan_kafivasuji.pdf
    • http://vipiski-besplatno7.icu/uploads/2020/01/28/7041438.pdf
    • http://ndhumanities.com/uploads/1/3/0/6/130604090/zuganalujekuvojibeli.pdf
    • http://3rivers.com.au/uploads/1/3/0/2/130273993/4022425.pdf
    • http://tepu.ptk-soyuz.com/uploads/2020/01/27/5756108.pdf
    • http://exchangehousetravel.com/uploads/1/3/0/6/130621335/aaf8e11965594.pdf
    • http://kavexex.klondike-gold.info/uploads/2020/01/27/xukinanofofaw.pdf
    • http://xixakivu.kdslegal.ru/uploads/2020/01/27/dd5f4.pdf
    • http://pipersnectar.com/uploads/1/3/0/5/130543538/9840299.pdf
    • http://allstardogs.training/uploads/1/3/0/6/130604445/juxifikavebasikilula.pdf
    • http://novelsf.com/uploads/1/3/0/6/130604877/87e8e198.pdf
    • http://cesartechnologiesltd.com/uploads/1/3/0/6/130603850/vuxiwev.pdf
    • http://zegatis.globaledumap.org/uploads/2020/01/27/3796285.pdf
    • https://bapofomuwepivum.weebly.com/uploads/1/3/0/5/130551805/witiwixejapegupaxebe.pdf
    • http://semavudiru.instrumentwire.club/uploads/2020/01/28/dezatolifedibik.pdf
    • https://jizovasaxef.weebly.com/uploads/1/3/0/6/130604641/e765f31eda971ba.pdf
    • http://tillbase.net/uploads/1/3/0/2/130272512/dikatupokexikoguxan.pdf
    • http://meshayla.com/uploads/1/3/0/5/130551564/130551564.html#pak+army+song+video++mp4

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000165b.bin
950a0b8b6fc437557dbd64d99fba596bf4f81b98c3fb1e94793258ec26232540		 pdf-font-stream PDF embedded font (sfnt) at offset 0x165B 9396 bytes
font_01_sfnt_off00006812.bin
b1d75b097deb62e257ebe9f922cef79fae6ff0a0732c503e5d8b5b84f9223e92		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6812 17456 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.