Malicious PDF — malware analysis report

Static analysis result for SHA-256 6361760d6bb36f88…

MALICIOUS

PDF

59.8 KB Authoring application: Poppler-utils
MD5: 125c8d14a24ddfad174e7b9181253d12 SHA-1: 585b46a224b4662e56b83d82de24949ccba0f168 SHA-256: 6361760d6bb36f88af5b55735a5ad85f24d14deac7a6f3cc120287ecd0959ff9
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of embedded URLs pointing to other PDF files, a technique often used for SEO spam or to distribute malicious content. ClamAV identified this as 'Pdf.Phishing.TtraffRobotInstall-7605656-0', indicating a phishing or traffic redirection scheme. The document body, though heavily obfuscated, contains references to 'Bengali typing keyboard for android' and links to external PDFs, reinforcing the lure-based nature of the attack.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://faberanot.skynetdonate.xyz/uploads/2020/01/27/pawilibofe.pdf
    • http://lowcostphotobooths.co.uk/uploads/1/3/0/3/130379426/26ae0c98b4c061.pdf
    • http://nileshsp.com/uploads/1/3/0/2/130291676/f7808c98c.pdf
    • http://404audio.weebly.com/uploads/1/3/0/4/130489128/vevatitebux.pdf
    • http://bbnla.com/uploads/1/3/0/6/130604892/nuregemirimidib.pdf
    • https://zizugevowuxovi.weebly.com/uploads/1/3/0/5/130551943/6ace95c121e242.pdf
    • http://specblend.com/uploads/1/3/0/6/130604369/linivikezode.pdf
    • http://travistrevisan.net/uploads/1/3/0/4/130436197/bugunavup.pdf
    • http://bawide.uaenoon.net/uploads/2020/01/27/6351905.pdf
    • http://rehphotography.org/uploads/1/3/0/6/130639965/130639965.html#bengali+typing+keyboard+for+android
    • http://fedorahosted.org/lohit
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License
    • https://savannah.gnu.org/projects/freefont/
    • http://www.gnu.org/licenses/
    • http://www.gnu.org/copyleft/gpl.html

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001227.bin
db49171fbb3d0a685cb8239fb99724feb1537de7220125a2fb332c214f8ed53b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1227 8740 bytes
font_01_sfnt_off00005e7d.bin
d7a23342410d97d84b64099cf9b0f8721a1ae592246a174c2573b0c4993ab2ac		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5E7D 17532 bytes
font_02_sfnt_off00007829.bin
b251e00b4eea5cbc23adf0180395c4102aea23bcfb5d03ea18ed6a7b261a67d7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7829 2008 bytes
font_03_sfnt_off000081c0.bin
9e11a7b808c6f077e77637e615a40b7398075e546a890fa14ee372fee823cb52		 pdf-font-stream PDF embedded font (sfnt) at offset 0x81C0 9444 bytes
font_04_sfnt_off00009bd3.bin
072978e660dffea8bf99aed85ed9b9dbc9557de53dbd3bf07815eed6e2e276e3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9BD3 10428 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.