Malicious PDF — malware analysis report

Static analysis result for SHA-256 66207eb55199d844…

MALICIOUS

PDF

36.8 KB Authoring application: Soda PDF
MD5: ab420829924171b69a71d858ba8af934 SHA-1: 4772ebd188b038c4737416f73db289170c854d65 SHA-256: 66207eb55199d8442275e2a426f9b096251d0e5ea0e86b0e90d61181158783dd
160 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of external links, many of which appear to be dynamically generated, suggesting a link farm designed to host malicious content. The presence of a 'download button' heuristic further supports the idea that the document is a lure. ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' indicates a phishing or malicious download campaign.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://eventcible.com/uploads/1/3/0/7/130738963/baruzinuku.pdf
    • http://ethansanderlin.com/uploads/1/3/0/2/130289310/5532050.pdf
    • http://redshedmarket.com/uploads/1/3/0/8/130813837/c8b67cc61.pdf
    • http://www.buildingservice.org.uk/uploads/1/3/0/2/130288753/9e49205d68.pdf
    • http://moco-bay.com/uploads/1/3/0/7/130775676/c85b4d.pdf
    • http://assistancedogassociation.com/uploads/1/3/0/3/130313000/wovuxawujusiwa_wisilenivaw_nivojawafa_medabifixo.pdf
    • http://miznora.com/uploads/1/3/0/7/130775506/1065396.pdf
    • http://webmail.indenturedservants.org/uploads/1/3/0/8/130814421/povigujuxamopuzefoja.pdf
    • http://bayoudivas.com/uploads/1/3/0/5/130540040/pewizubumotasuxezopa.pdf
    • http://pcpanelsolutions.com/uploads/1/3/0/7/130776114/456117.pdf
    • http://birthbydesigndoulas.com/uploads/1/3/0/6/130621374/3548912.pdf
    • http://pueblocopainting.com/uploads/1/3/0/7/130739593/582608.pdf
    • http://pickapassword.com/uploads/1/3/0/8/130814993/likevili-nejuronera-zakosux-lujed.pdf
    • http://storyspinner.net/uploads/1/3/0/5/130551058/wupipagegavisa-larogopadetot-buvopuzisim-buruwidikulibi.pdf
    • http://mpowerbuilding.ca/uploads/1/3/0/5/130550858/5d5082.pdf
    • http://www.annejacobsonmusicstudio.com/uploads/1/3/0/8/130874252/wabimuki.pdf
    • http://lacevicherianyc.com/uploads/1/3/0/5/130588980/gikatupomo-ginarumupumavu-ridem.pdf
    • http://moongsushi.online/uploads/1/3/0/6/130620843/3250635.pdf
    • http://albertokeel.com/uploads/1/3/0/4/130476263/zobav.pdf
    • http://triplex-arrow.com/uploads/1/3/0/3/130379246/4734436.pdf
    • http://tashedynasty.com/uploads/1/3/0/5/130588640/63d50c68449f2a3.pdf
    • http://nederland-verzilvert.nl/uploads/1/3/0/3/130313359/wowizuxigutaw-xuvusugigixaj.pdf
    • http://6zt2m.salon225.com/uploads/1/3/0/7/130740483/130740483.html#adobe+reader+win+xp+free+download

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002eee.bin
e2b55b88089dbf4179a721445419f6a03219cef2873ddac56a287808676d6b92		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2EEE 7644 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.