Malicious PDF — malware analysis report

Static analysis result for SHA-256 58c0b4656b831526…

MALICIOUS

PDF

55.8 KB Authoring application: PDFedit
MD5: b589c434d554f318c9e3825d350f3c37 SHA-1: 6e40547a09ee57f220600443b9dd48a53a573439 SHA-256: 58c0b4656b83152654800cac5d1c9eadaf55eed7173f7b68c7de97e28257653c
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links to external PDF files, a technique often used for SEO spam or to distribute malicious content. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the ML classifier output strongly indicate malicious intent. The document body is heavily corrupted, preventing a more detailed analysis of its specific lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://xinexas.habana-moscu.com/uploads/2020/01/27/624ab4e5.pdf
    • http://beres.wiki-compac.info/uploads/2020/01/28/jewox-fiwogekixom-gupotusisiw.pdf
    • http://woxabuwoj.megatest.org/uploads/2020/01/29/vunizepevub.pdf
    • http://gaporun.knb-games.pw/uploads/2020/01/28/fazuditiviko.pdf
    • http://pufeketap.pinhs-ap.com/uploads/2020/01/28/7907289.pdf
    • http://wazejogona.tastydowns.com/uploads/2020/01/29/zerazigi_samekonaru_wapowuxetejugoj_zagiwewedas.pdf
    • http://descurieuxthierry.com/uploads/1/3/0/3/130323155/jivete.pdf
    • http://heartofachildministries.net/uploads/1/3/0/5/130590582/a85a195972.pdf
    • http://bolusijiz.flame.company/uploads/2020/01/29/5a636837ceb.pdf
    • https://lisadusaz.weebly.com/uploads/1/3/0/5/130589207/vutirur.pdf
    • http://greenaccountingservices.us/uploads/1/3/0/2/130272638/mixemowidon.pdf
    • http://serwiskotlow.pl/uploads/1/3/0/3/130313741/fe3d3515216ee.pdf
    • http://kusatori.info/uploads/2020/01/27/pifawatokajiwi_vovafegilofesi.pdf
    • http://laurendevore.com/uploads/1/3/0/5/130590507/vifavoweda.pdf
    • https://fuwovelijuvez.weebly.com/uploads/1/3/0/3/130323822/ximakasutavenizobaza.pdf
    • http://mindworksfit.com/uploads/2020/01/28/molilikowodogazawa.pdf
    • http://revelationyogafaith.com/uploads/1/3/0/5/130545681/4138144.pdf
    • http://rujuliva.uristlaboratory.ru/uploads/2020/01/28/sibunixogababexuwu.pdf
    • https://fuduzomuxanexi.weebly.com/uploads/1/3/0/4/130483539/japeke.pdf
    • http://dawiropaja.audiostart16.icu/uploads/2020/01/28/6915958.pdf
    • https://nibegusowok.weebly.com/uploads/1/3/0/4/130476322/jujukavukemapake.pdf
    • http://mesi.gamerspot.info/uploads/2020/01/27/sinizube.pdf
    • http://ritukowaba.budpervym.ru/uploads/2020/01/28/telewoneduketonugeg.pdf
    • http://guril.support-account.net/uploads/2020/01/27/9fc60e2dc.pdf
    • http://jipapuweg.retinuelk.info/uploads/2020/01/27/be8dbc0.pdf
    • http://truckdiva.com/uploads/1/3/0/6/130620197/130620197.html#esen+10+s%C4%B1n%C4%B1f+matematik+konu+%C3%B6zetli+soru+bankas%C4%B1+pdf
    • http://rujuliva.uris

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001770.bin
f0736a250c6b7a71fe54b2a6648c450ae95920719765126c70f1dc77382d1d55		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1770 10260 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.