Malicious PDF — malware analysis report

Static analysis result for SHA-256 36261aee5323ad16…

MALICIOUS

PDF

44.9 KB Authoring application: PDFedit
MD5: a5bf79b1c3306d07bc6dc1319c54b6cc SHA-1: 7122bcc1c54c49f002c042de1d9663ff6d778408 SHA-256: 36261aee5323ad16892ae167cf7574218b1e6a7259129bc44896e51235634f8f
158 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1566.002 Spearphishing Attachment

This PDF file was detected as malicious by ClamAV and a machine learning model, indicating a high likelihood of malicious intent. The PDF contains an embedded JavaScript stream and a large number of external PDF links, suggesting it is part of a link farm designed to redirect users to malicious content. The document body, though partially corrupted, contains text related to accounting interview questions and includes numerous URLs, reinforcing the phishing or redirection lure. The primary attack pattern involves using a seemingly legitimate document to trick users into accessing and potentially downloading further malicious files.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://vukerikokuw.weebly.com/uploads/1/3/0/5/130551534/1a4fa117f71.pdf
    • http://kanomtravel.com/uploads/2020/01/28/1838287.pdf
    • https://vukerikokuw.weebly.com/uploads/1/3/0/5/130551534/36f4e44ef674.pdf
    • https://ripizaxavanol.weebly.com/uploads/1/3/0/6/130603824/givuxojoz.pdf
    • http://deto.klubok-kolobok.ru/uploads/2020/01/27/logojifumevite.pdf
    • http://bolew.mega-blog7.ru/uploads/2020/01/27/donewila.pdf
    • http://finug.kc-x.ru/uploads/2020/01/28/6d6be4905742e.pdf
    • https://ronojanakut.weebly.com/uploads/1/3/0/4/130436224/3520203.pdf
    • http://gradnia.ru/uploads/2020/01/27/8624099.pdf
    • http://mor.gdetabletka.ru/uploads/2020/01/29/79b019bc23.pdf
    • http://numaluvuf.familiarizarse.info/uploads/2020/01/28/lubur.pdf
    • http://weri.mimosaweb.com/uploads/2020/01/27/riwalukaluzotoju.pdf
    • http://tanaguz.onkologicheskaya-patalogiya-i-eco.ru/uploads/2020/01/27/kubijiletib_vovigiwulevi.pdf
    • http://dgsfjhgj.top/uploads/2020/01/28/1340669.pdf
    • http://faithmirror.com/uploads/2020/01/28/6666490.pdf
    • https://vimozewolamivo.weebly.com/uploads/1/3/0/6/130604326/6498110.pdf
    • http://roud-like.ru/uploads/2020/01/28/kanisugi.pdf
    • https://jojazuvisanipe.weebly.com/uploads/1/3/0/5/130544872/zilinab_gibuduvib_gajimifa.pdf
    • https://gakegobadesumes.weebly.com/uploads/1/3/0/3/130323612/5997549.pdf
    • https://bomuwowawon.weebly.com/uploads/1/3/0/5/130588842/sikenokilale.pdf
    • http://xagawibo.cncsnab.ru/uploads/2020/01/28/d15599.pdf
    • http://gossort.com/uploads/2020/01/27/nuvekaraluduxigevim.pdf
    • http://originallamp.ru/uploads/2020/01/27/kixolufedulu.pdf
    • http://pavlogradgallery.ru/uploads/2020/01/27/7b79b63059609a0.pdf
    • http://lapaginadelreloj.com/uploads/1/3/0/2/130289732/130289732.html#basic+accounting+questions+asked+in+interview+pdf

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000169a.bin
dabe6fe9e5d39a57686b8a92a5f01847721cc5a586d6f36b23bd7cd6e682276a
pdf-font-stream PDF embedded font (sfnt) at offset 0x169A 8304 bytes