Malicious PDF — malware analysis report

Static analysis result for SHA-256 674e31ac69e5b672…

MALICIOUS

PDF

39.7 KB Authoring application: Mobipocket Creator
MD5: 22aa72d2f9b858ea0d96ac44a951081e SHA-1: 1d5548db60911ededd7b262b2a3b6aaeced76ef0 SHA-256: 674e31ac69e5b672c471cf8b9702d8552abc9cd07087b72f100b004c9252059d
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file contains a large number of embedded URLs pointing to external PDF documents. This behavior is indicative of a link farm or SEO manipulation tactic, as flagged by the PDF_SEO_LINK_FARM heuristic. The ML classifier and ClamAV also strongly indicate maliciousness. While no scripts were explicitly extracted, the embedded URLs themselves are the primary indicators of malicious activity.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://wezusazaxep.weebly.com/uploads/1/3/0/4/130483355/nasas.pdf
    • http://signsmemphis.net/uploads/1/3/0/2/130272619/karupeder.pdf
    • http://nopun.o-studia.ru/uploads/2020/01/27/0f8d7dab452.pdf
    • http://dofevexas.144lonn.xyz/uploads/2020/01/28/vevaxatuzobedonexu.pdf
    • http://rizuzo.sexshop-extra.ru/uploads/2020/01/29/mamusali.pdf
    • https://mibevofura.weebly.com/uploads/1/3/0/4/130494636/4400971.pdf
    • https://suxejifobobam.weebly.com/uploads/1/3/0/5/130539792/gumemiwule.pdf
    • http://fixas.atlla.ru/uploads/2020/01/27/434338a.pdf
    • http://smartmartwireless.com/uploads/1/3/0/6/130621089/bokefulisanaxunaroxa.pdf
    • https://dupefovidux.weebly.com/uploads/1/3/0/5/130543437/9508317.pdf
    • http://vozati.letstakemetoad.com/uploads/2020/01/29/4753109.pdf
    • http://projectrangatahi.com/uploads/1/3/0/2/130271047/2287643.pdf
    • https://likigapawizi.weebly.com/uploads/1/3/0/3/130313117/zuvuken.pdf
    • https://zipomizadexaj.weebly.com/uploads/1/3/0/5/130539912/4498582.pdf
    • http://arsic.org/uploads/1/3/0/2/130272906/bisobedob.pdf
    • https://bazolisejafebal.weebly.com/uploads/1/3/0/5/130551000/nawokusumanit.pdf
    • http://five2flourish.com/uploads/1/3/0/5/130588923/mavim.pdf
    • http://beadsbybella.com/uploads/1/3/0/6/130620776/1e371.pdf
    • http://roni.lulacrib.com/uploads/2020/01/28/a27c47.pdf
    • http://gawamojew.tiadasempanadas.com/uploads/2020/01/27/c9eab19d180ad2.pdf
    • http://kona.americanasdobrasil.com/uploads/2020/01/28/4563279.pdf
    • http://johnraywatts.com/uploads/1/3/0/5/130588586/2d78e.pdf
    • http://donat-to-katerina.com/uploads/2020/01/27/2302946.pdf
    • http://1tv-allknulo.ru/uploads/2020/01/29/lanelefozezuta.pdf
    • http://xojurefor.autogost.com/uploads/2020/01/27/6483766632c.pdf
    • http://cfthomas.com/uploads/1/3/0/5/130551675/130551675.html#lds+creation+coloring+pages

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001813.bin
f685a72e287844ba6bf04dd63d7734f7b88b819506a82d28ba72695327cca28e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1813 7628 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.