Malicious PDF — malware analysis report

Static analysis result for SHA-256 432a6bec4fb04307…

MALICIOUS

PDF

33.4 KB Authoring application: SWFTools
MD5: f2e0c686c21fc6c5bec26a6b8ae58daa SHA-1: 2b991e8c8faebcbd3c0e58a23d0ee78b03d247b7 SHA-256: 432a6bec4fb0430718c5eefe37fc23e07161d4108200c20d1a72e91fb0843a73
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links to external PDF files, a technique often used for SEO poisoning or to redirect users to malicious content. The heuristic 'PDF_SEO_LINK_FARM' and ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' strongly indicate a phishing or malicious redirection attempt. The document body itself contains garbled text and the URLs, suggesting the primary function is to host these links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://remcofitness.com/uploads/1/3/0/5/130550824/kumagomivof-nowuwelagegoga-gasog.pdf
    • http://onlygodcanjudgeus.com/uploads/1/3/0/5/130543289/jufot.pdf
    • http://alexdanielski.com/uploads/1/3/0/4/130489669/zoxijugugaxowate.pdf
    • http://woozeyacresllc.com/uploads/1/3/0/2/130287845/xuguk.pdf
    • http://artofmoses.com/uploads/1/3/0/3/130323934/6ce77f0bce.pdf
    • http://superliker.ru/uploads/2020/01/28/nagabijamox_bagejogelobibi.pdf
    • http://ankezimmermann.ca/uploads/1/3/0/7/130740533/6744785.pdf
    • http://naughtybottom.net/uploads/1/3/0/2/130289503/1833724.pdf
    • http://myfirstroots.com/uploads/1/3/0/2/130288830/jubazujizivon_fopazidarezebu_pikivopige_bogukoxulolukom.pdf
    • http://ncpchoirs.com/uploads/1/3/0/5/130550869/1456619.pdf
    • http://warrenbaker.org/uploads/1/3/0/5/130550782/wusudevivorubi.pdf
    • http://tamarko.com/uploads/1/3/0/5/130539270/ff047339dbae6.pdf
    • http://cityonloc.com/uploads/1/3/0/6/130621645/130621645.html#ankarali+ibocan+indir

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001340.bin
26e77fe22a0ad2264728438b4f548d74e666d033840da2855cf9551e6f439591		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1340 9356 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.