Malicious PDF — malware analysis report

Static analysis result for SHA-256 66c3ca66238f36a8…

MALICIOUS

PDF

40.1 KB Authoring application: Mobipocket Creator
MD5: 746b628328fa9decfc98cdd5f7bdd5a9 SHA-1: 86c5b410fc6bb1ed021964f35e877c903bc3c9fa SHA-256: 66c3ca66238f36a84c89a94dfb38e857c7e4633a3667746f6874140d31bda382
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file contains a large number of embedded external links, identified as a link farm. This heuristic, combined with ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0', strongly suggests a phishing or malware distribution attempt. The embedded URLs are likely intended to redirect users to malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://guwogifofifen.weebly.com/uploads/1/3/0/3/130323836/taxowidulasubu.pdf
    • http://bourbonblast.com/uploads/1/3/0/2/130291908/safapagupuxekiz.pdf
    • http://kliningovaya-kompaniya.pro/uploads/2020/01/27/3701613.pdf
    • http://gikovupo.majesticpin.site/uploads/2020/01/29/1510446.pdf
    • http://theleawoodfamilydentist.com/uploads/1/3/0/5/130543364/cdab804413.pdf
    • http://cornbreadbuffetkc.com/uploads/1/3/0/6/130605291/pawiwagodukinodoba.pdf
    • http://xomeb.manvs.ru/uploads/2020/01/29/a2d051be.pdf
    • http://pipod.vid-downloader.tech/uploads/2020/01/28/zenik-putovojekomeb-wuvapesegavi.pdf
    • http://suttonjoi.com/uploads/1/3/0/2/130289603/furibe-fexijo-putawuwala-lonelu.pdf
    • http://lemopa.zubecar.org/uploads/2020/01/29/9220422.pdf
    • http://jedubibet.lariveracr.com/uploads/2020/01/28/0e694089273.pdf
    • http://luostarituote.fi/uploads/1/3/0/2/130270955/4863843.pdf
    • http://meguzalip.st-kino.ru/uploads/2020/01/28/fufenuzolo.pdf
    • http://kisen.pitprombu.ru/uploads/2020/01/28/vepivajutem.pdf
    • https://dapizekabakeva.weebly.com/uploads/1/3/0/3/130379094/66632.pdf
    • http://lashesbyjoanne.com/uploads/1/3/0/5/130545096/sapaxet_tofeji.pdf
    • http://keepitlocalaustin.com/uploads/1/3/0/5/130539990/2319044.pdf
    • http://rome.migraskop.com/uploads/2020/01/28/posoroniza.pdf
    • http://vaf.speacetech.us/uploads/2020/01/28/9554421.pdf
    • http://cyclebavaria.com/uploads/1/3/0/4/130436357/lidubunajij-narelitejedib-bivirirenegate.pdf
    • http://drjuris--office.com/uploads/1/3/0/6/130604532/130604532.html#ccna+routing+protocols+pdf

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001780.bin
95a812b905236337f76c30249789871edd11398cb0598a22bf97b1f4c9042e9f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1780 8064 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.