Malicious PDF — malware analysis report

Static analysis result for SHA-256 2ebdc1613f995b12…

MALICIOUS

PDF

38.5 KB Authoring application: pdf-parser
MD5: 054babffb037c694555d8a5bfa2e8015 SHA-1: dd19e921cfa53749e98d4bac762c04b1cfa2a86e SHA-256: 2ebdc1613f995b128019a063b583dd78c726c8bcaca76ebbc55030a6aa4117d6
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was flagged by multiple heuristics, including a critical finding for a link farm containing numerous external URLs. The ML classifier also strongly indicated maliciousness. The embedded URLs, such as http://vafsnews.com/uploads/1/3/0/5/130588551/f75579113a55b2.pdf, are likely part of a phishing or malware distribution scheme. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://vafsnews.com/uploads/1/3/0/5/130588551/f75579113a55b2.pdf
    • http://canterburynorthwestern.org/uploads/1/3/0/6/130620796/feximavododi.pdf
    • https://rivoralovoz.weebly.com/uploads/1/3/0/4/130435644/708704.pdf
    • http://thedailytalkkc.com/uploads/1/3/0/3/130379104/pawojoxaz.pdf
    • http://nordparkspb.com/uploads/2020/01/28/vewesuzi.pdf
    • http://ballroomalliance.com/uploads/1/3/0/4/130436079/pudojigefixude_tolobere_lavolowavepe_zusonido.pdf
    • http://equilibrium-psyche.ru/uploads/2020/01/27/vupepakusowil.pdf
    • http://puxoxumi.like-ball.com/uploads/2020/01/28/9087878.pdf
    • http://namastamyoga.com/uploads/1/3/0/2/130274145/7642399.pdf
    • http://053748270.com/uploads/1/3/0/6/130639689/3132246.pdf
    • http://saxu.suppasides.win/uploads/2020/01/28/bogexonaba_duwomavukux_nodopazarurevum_pakib.pdf
    • http://thetwigwarehouse.com/uploads/1/3/0/3/130323555/migadedudonimutajari.pdf
    • https://gufibisara.weebly.com/uploads/1/3/0/3/130380037/680765.pdf
    • http://duduslimmer.com/uploads/1/3/0/5/130588459/a78f9acb.pdf
    • http://lavishevent-design.com/uploads/1/3/0/4/130488875/xunologovasorix_sosibu_sevotutimobu.pdf
    • http://kupalniky.online/uploads/2020/01/27/d08fd4845ae36cf.pdf
    • https://lekelidoka.weebly.com/uploads/1/3/0/2/130289377/3932635.pdf
    • http://bearcreekpd.com/uploads/1/3/0/3/130313252/8434478.pdf
    • https://wevexilejufi.weebly.com/uploads/1/3/0/3/130379170/498401.pdf
    • http://realestatecareerjacksonvillenc.com/uploads/1/3/0/5/130588207/lamenitor-denuvota.pdf
    • http://mobilemechanicinperth.com/uploads/1/3/0/3/130324289/wutugo-fisesoberewo-munazebekobuz-jimasus.pdf
    • http://bsa-sccc-pack301.com/uploads/1/3/0/5/130543402/130543402.html#winnie+the+pooh+piano+sheet+music+pdf

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000168d.bin
a95060ec25e08738885d03158fa511fa328b84258b426d0899f10624fe460c4d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x168D 9720 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.