Malicious PDF — malware analysis report

Static analysis result for SHA-256 68c583c64f4ea05e…

MALICIOUS

PDF

55.1 KB Authoring application: Mobipocket Creator
MD5: d799fe6af6cec359c2f982b8108786ea SHA-1: 7df4aaf27638c96d501ee886164969e7d8835cb7 SHA-256: 68c583c64f4ea05e3c07be0823b8cb8aa4057ff8cdfc62084ba6c95462527985
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic, pointing to various PDF files hosted on different domains. This behavior is indicative of a link farm or a phishing campaign designed to redirect users to potentially malicious content. The ML classifier and ClamAV detection further support the malicious nature of this file.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://shopsexxyness.com/uploads/1/3/0/2/130289563/pizanesabowigawe.pdf
    • https://madibujerotozig.weebly.com/uploads/1/3/0/5/130588676/5459307.pdf
    • http://beyondstockllc.com/uploads/1/3/0/4/130435960/7375873.pdf
    • https://zupalejodole.weebly.com/uploads/1/3/0/4/130436451/368f7.pdf
    • http://lod.slmlow.ru/uploads/2020/01/28/tarofew.pdf
    • http://milesalumniatl.com/uploads/1/3/0/2/130270889/wifuwimekomob-pipozuma-kepufuz-jonozuzedo.pdf
    • http://dougstewartcircus.com/uploads/1/3/0/3/130323928/f21e4274dd4.pdf
    • http://helps-disputed-accountverify834.com/uploads/1/3/0/4/130489803/xadosoteg.pdf
    • http://balance-buddies.com/uploads/1/3/0/2/130289763/8640890.pdf
    • http://tipmoscow.ru/uploads/2020/01/28/2413554.pdf
    • http://destindream.com/uploads/1/3/0/4/130490155/d2213e7c.pdf
    • http://calyculin.com/uploads/1/3/0/4/130489228/8cfde1a1761626d.pdf
    • http://tuzuzejubo.baksmans.club/uploads/2020/01/28/lunuxuxaxato.pdf
    • http://artfulconnections.net/uploads/1/3/0/2/130270937/suwatevu_bogaba_foguzudoko.pdf
    • http://soontravelagency.net/uploads/1/3/0/6/130620857/7986127.pdf
    • http://mooreintconsulting.com/uploads/1/3/0/4/130479389/6509177.pdf
    • https://xadigavifakajof.weebly.com/uploads/1/3/0/5/130551957/e72f2fc3.pdf
    • http://teamjaime.com/uploads/1/3/0/5/130539354/48b852ec7102.pdf
    • http://stbirgittapdx.weebly.com/uploads/1/3/0/6/130639192/7723741.pdf
    • http://myrnaphillips.com/uploads/1/3/0/6/130639845/839ca485cd1bc90.pdf
    • https://managapelebe.weebly.com/uploads/1/3/0/5/130588681/d3145e84698b21d.pdf
    • http://saturnsthoughts.com/uploads/1/3/0/4/130478648/jumawixi_mototapemono.pdf
    • http://msmagnosjcs.com/uploads/1/3/0/2/130271214/9009e4.pdf
    • http://blueseasmarinesurveys.com/uploads/1/3/0/6/130621651/130621651.html#appointment+with+death+poirot+pdf

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001362.bin
66f59a791c9b8c5150f63c483a0e2e7ffbce7c4149d999c0e27c1312fd375a34		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1362 8976 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.