Malicious PDF — malware analysis report

Static analysis result for SHA-256 6a9bcd1d954cc813…

MALICIOUS

PDF

55.5 KB Authoring application: ImageMagick
MD5: 00d28da421368d056fb7ad93b941e17c SHA-1: 2be46ef0cad2996dbcfec2e791c8c5c7756c72fd SHA-256: 6a9bcd1d954cc8136d3acd4f8439eb98a613237639f5e0b6535c0e50aedbea79
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF was flagged by multiple heuristics, including ClamAV and an ML classifier, as malicious. It contains a large number of embedded URLs pointing to other PDF files, suggesting a link farm or a distribution mechanism for further malicious content. The presence of embedded URLs and the nature of the detection indicate a phishing or malware distribution attempt, likely delivered as a spearphishing attachment.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://texipofoj.manvs.ru/uploads/2020/01/27/figebaretitu_larej.pdf
    • http://jeromesbistro.com/uploads/1/3/0/2/130272963/c7436a0258265.pdf
    • http://formationalurimmobilier.com/uploads/1/3/0/2/130287847/f83eb59bfbeddc7.pdf
    • http://billingsequestrian.com/uploads/1/3/0/4/130491075/ab46a72940061a.pdf
    • http://synodcanada.com/uploads/1/3/0/5/130543466/761e4b94.pdf
    • http://shopcariscloset.com/uploads/1/3/0/5/130546183/sabetipu.pdf
    • http://torreazul.es/uploads/1/3/0/2/130289272/turitev_pukobokom.pdf
    • http://morealestatebook.com/uploads/1/3/0/4/130479123/55e038c9.pdf
    • https://kisafakawepa.weebly.com/uploads/1/3/0/4/130435582/jitafovaxerafokezoxe.pdf
    • http://wuru.ed-pro.ru/uploads/2020/01/29/1948423.pdf
    • http://toontownstories.com/uploads/1/3/0/5/130545885/dinexemotudi-dudagujesev-lanonofasuniv.pdf
    • http://northcountryhomeinspection.com/uploads/1/3/0/4/130476074/9166611.pdf
    • http://rubymacfashion.com/uploads/1/3/0/3/130313343/13a8df3b6.pdf
    • https://fufubumutop.weebly.com/uploads/1/3/0/4/130436473/pirifejapupap.pdf
    • http://wisevifad.preventus.ru/uploads/2020/01/28/329935.pdf
    • http://everyday-sustainability.com/uploads/1/3/0/6/130621698/ligomijo_ruluxe_mapubidagagon.pdf
    • http://pp-offer.pro/uploads/2020/01/27/befeworo_kovup_nisunitiketo.pdf
    • http://aquariusfunding.com/uploads/1/3/0/4/130489001/130489001.html#andy+android+emulator+wikipedia

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000013ab.bin
f8cf717add66ff0bf6f776abcb621f6d5eadba8a91a7df74383a81a4f5bee2d2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13AB 9192 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.