Malicious PDF — malware analysis report

Static analysis result for SHA-256 6ae2a1c22dd1cc09…

MALICIOUS

PDF

115.4 KB Authoring application: SWFTools
MD5: ceac0251321969364e60eaebbcb22f73 SHA-1: 1440ef95795be769fa4c0c46790a0e6f620c363c SHA-256: 6ae2a1c22dd1cc09f2e67a2e356c5938cb8e32d2a4a0e88074635f5de36be689
160 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of embedded external links, a technique often used for SEO poisoning or to redirect users to malicious sites. The heuristic 'PDF_SEO_LINK_FARM' specifically identifies this behavior, indicating a likely attempt to distribute malware or conduct phishing. While no scripts were directly extracted, the nature of the embedded links suggests a malicious intent to lead users to potentially harmful content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9969

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Urgency / deadline lure low SE_URGENCY_LURE
    Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://brandonhighlandfestival.ca/uploads/1/3/0/6/130621677/dojeto.pdf
    • http://roxu.blamecharlie.com/uploads/2020/01/27/5483250.pdf
    • https://sopixizuzema.weebly.com/uploads/1/3/0/4/130494172/0dc44ea68e0.pdf
    • http://narrins.com/uploads/1/3/0/4/130436154/xuvuv.pdf
    • http://vassilopouloslab.com/uploads/1/3/0/4/130483219/zosut.pdf
    • http://wizer.hojiakfoods.com/uploads/2020/01/27/zogizuwigoliguruz.pdf
    • http://midubovas.belvit.by/uploads/2020/01/27/8826181.pdf
    • http://healthmonitoring.tech/uploads/2020/01/29/zevikoli-vafagigusiritu.pdf
    • http://kueadressesdesign.com/uploads/1/3/0/5/130589202/25bc4d.pdf
    • http://arcadiagardensllclandscapinganddesign.com/uploads/1/3/0/3/130323407/130323407.html#treatment+of+acute+inferolateral+myocardial+infarction
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://fedoraproject.org/wiki/Licensing/LiberationFontLicense

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000013b8.bin
5d729ee03794579ac1bc6600c4102c8bc7e86fe2cd2066a9dfcd79f175f5c86b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13B8 10436 bytes
font_01_sfnt_off0000fca0.bin
c048ac4ed90d63bfae46472f65f9cf6fc0bd5e75369f2d8f28771a6d96a2731c		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFCA0 3156 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.