Malicious PDF — malware analysis report

Static analysis result for SHA-256 6705fe6568d87b2e…

MALICIOUS

PDF

39.7 KB Authoring application: ImageMagick
MD5: 7499550af9dff7fe61fc4a0ef997d5db SHA-1: dc114ea23b819f09a4057ae92e31b6c2c8facdb6 SHA-256: 6705fe6568d87b2e5b461a15a12fdb6f1fd8ac24f00b103651a1019d51baccf0
200 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of external links, a technique often used for SEO poisoning or to redirect users to malicious sites. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the ML classifier output strongly indicate malicious intent. While no scripts were explicitly extracted, the presence of numerous URLs suggests a potential for downloading further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • PDF link to algorithmically-generated URL high PDF_RANDOM_URL_LINK
    PDF contains a clickable HTTP(S) link whose host looks algorithmically generated (pronounceable-random labels) and whose path/query carries a long high-entropy token. This is the randomized-redirector pattern of malspam phishing lures — the visible document is only a prompt — not a PDF parser vulnerability.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://beautybehindbars.org/uploads/1/3/0/6/130639865/wotufugasofazigutena.pdf
    • http://megazin.fun/uploads/2020/01/29/mipudebuwomek.pdf
    • http://mudhookbc.com/uploads/1/3/0/5/130590738/6171229.pdf
    • http://uranalitika.ru/uploads/2020/01/28/5606486.pdf
    • http://mountainplayschool.com/uploads/1/3/0/6/130604529/49fcf3f9c.pdf
    • http://sharalynedgeberg.com/uploads/1/3/0/6/130621703/73dae9a0fc2.pdf
    • http://newborntaxidermy.com/uploads/1/3/0/5/130551065/14b62a.pdf
    • http://nasdwkas.icu/uploads/2020/01/28/xajogopaz.pdf
    • http://usafachapters.org/uploads/1/3/0/6/130604785/53634.pdf
    • http://hesperianmusic.com/uploads/1/3/0/5/130588830/b0b47c07a.pdf
    • http://montecristifinesouthamericanarts.com/uploads/1/3/0/5/130539336/novijalifeponux_kowemetajom_guwigoge.pdf
    • http://dorothyradio.com/uploads/1/3/0/5/130546415/moxezilorinitu.pdf
    • http://easy-studies.com/uploads/2020/01/28/964ef16c73.pdf
    • http://xikemas.klubok-modno.ru/uploads/2020/01/27/palefop_dozejomepekoman.pdf
    • https://nozevojifuniba.weebly.com/uploads/1/3/0/6/130604307/mivoner_bolumuzuxefosi_fikara_gufadidugo.pdf
    • https://womiwide.weebly.com/uploads/1/3/0/2/130287521/nakawebos.pdf
    • http://drandrewlukaris.com/uploads/1/3/0/6/130621036/welenesixiz.pdf
    • http://naughtonsandblastinggalway.com/uploads/1/3/0/6/130639311/fakalojojixa.pdf
    • http://deardoc.org/uploads/1/3/0/6/130605161/7637794.pdf
    • http://jajutupux.powking1.ru/uploads/2020/01/27/4584977.pdf
    • http://5pointauto.com/uploads/1/3/0/6/130621003/130621003.html#ayyappa+swamy+telugu+songs++free

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000015e5.bin
ecc987f495a46ff43abbe7a4d33c4d894cebfd815a26815f31b66f33578f2994		 pdf-font-stream PDF embedded font (sfnt) at offset 0x15E5 8080 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.