Malicious PDF — malware analysis report

Static analysis result for SHA-256 68ee8ef7e7d1ae33…

MALICIOUS

PDF

40.2 KB Authoring application: QPDF
MD5: 6dda888fc5f1726b8f1bbb91f10ec0a6 SHA-1: 5fa5509e4d550c6927dc5b82261b11984d289541 SHA-256: 68ee8ef7e7d1ae332173ae57507fe9ee3b3c830180bd5a578e21224203433ef7
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF file was detected as malicious by ClamAV and an ML classifier, and exhibits a PDF_SEO_LINK_FARM heuristic. It contains a large number of embedded URLs pointing to external PDF files hosted on various domains. The document body contains garbled text and what appears to be a reference to shoulder impingement, but the primary malicious activity is the mass linking to external content. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://wildelements.com/uploads/1/3/0/3/130313561/jimosojoxi.pdf
    • http://nybestdentist.net/uploads/1/3/0/3/130312952/mugebidezedalapano.pdf
    • http://psycholoog-gooi.net/uploads/1/3/0/7/130775672/4106994.pdf
    • http://jazaxobeg.tricolor-koroyove.ru/uploads/2020/01/28/megerubejofuzev.pdf
    • http://ideas4entrepreneur.com/uploads/1/3/0/6/130620168/7816927.pdf
    • http://thisisallisonlee.com/uploads/1/3/0/6/130603779/fameju.pdf
    • http://cabinetdanconsulting.com/uploads/1/3/0/5/130539696/4350881.pdf
    • http://miguelsanomovie.com/uploads/1/3/0/2/130270779/tubikeranilol-dirivefojo-fanoludavulub-nujinitu.pdf
    • http://foothillsbiblefellowship.com/uploads/1/3/0/6/130621980/8810568.pdf
    • https://selugodov.weebly.com/uploads/1/3/0/5/130551651/7540502.pdf
    • http://jexeja.ssberprizee.info/uploads/2020/01/29/toluma.pdf
    • http://baumanntravels.com/uploads/1/3/0/3/130324241/2227715c2.pdf
    • http://ankezimmermann.ca/uploads/1/3/0/5/130539034/130539034.html#shoulder+impingement+def
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://fedoraproject.org/wiki/Licensing/LiberationFontLicense

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000012f8.bin
d64a6a2f8d143f83e0b478b0934545432e9c6da81f2a474f9889720bcb95fc86		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12F8 7860 bytes
font_01_sfnt_off00006231.bin
63f5e27ee3d24cc00d413e59c301cc73ab377383609796993547673f2bea898c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6231 2600 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.