Malicious PDF — malware analysis report

Static analysis result for SHA-256 69fc301f7e98512f…

MALICIOUS

PDF

36.5 KB Authoring application: PDF Studio
MD5: 8bd3d56aea4c21300302908355d41af5 SHA-1: 737b8037f80622a9ff3288f6075015e6696746bf SHA-256: 69fc301f7e98512f1d738c89858648ecf1212d018a63d732715ef4882f337003
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded links pointing to external PDF files, a technique often used for SEO poisoning or distributing malicious content. The ClamAV detection and ML classifier strongly indicate malicious intent. The embedded URLs are likely part of a campaign to redirect users to malicious sites or download further malware.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://myersfamilyunified.com/uploads/1/3/0/3/130379638/wadagane.pdf
    • https://jewatitesipomek.weebly.com/uploads/1/3/0/5/130540033/tofekavazanup-luxiripo-tubatirobuv-wadovave.pdf
    • http://xotuv.hoex.ru/uploads/2020/01/28/bogalepipafadasaxi.pdf
    • http://vana.dzairbest.com/uploads/2020/01/28/bebomixenafare.pdf
    • http://checkthem.in/uploads/1/3/0/6/130605447/24d2926f0c.pdf
    • http://soteam.org/uploads/1/3/0/5/130550698/d2aab82f.pdf
    • https://zonimesufaki.weebly.com/uploads/1/3/0/5/130538833/79f8f7dbc47.pdf
    • http://pegilo.gaskalyga.ru/uploads/2020/01/28/d76c75.pdf
    • http://leap4ward.org/uploads/1/3/0/5/130543837/ludagakiraki-wokid-xakamaduxipo-wajelekaxe.pdf
    • http://tixujuto.gaika.biz/uploads/2020/01/28/jatonapuwixixuli.pdf
    • http://precruit.nl/uploads/1/3/0/6/130604728/dokewejezikalal.pdf
    • http://thefajfar.com/uploads/2020/01/27/05c595c169.pdf
    • http://rmwcaf.org/uploads/1/3/0/4/130483510/67f2013e.pdf
    • http://capturingtheride.com/uploads/1/3/0/6/130620687/130620687.html#tesis+funcionamiento+familiar+y+consumo+de+alcohol+en+adolescentes

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000013e9.bin
86d906699d4326cf356d9c15fdf494ce6b817893596fe862c7eb5d11dff60fae		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13E9 9396 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.