Malicious PDF — malware analysis report

Static analysis result for SHA-256 6b23d93acf952cbb…

MALICIOUS

PDF

72.2 KB Authoring application: PDF Studio
MD5: f245c2c53c0481c9de4a7a04f0ec84c0 SHA-1: 53d80595e78abb67024f829688cb059359c8358c SHA-256: 6b23d93acf952cbbe9f12e11494a6db4e1594037a0265b83968a9662f7576099
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document contains a large number of embedded URLs pointing to external PDF files, identified by the 'PDF_SEO_LINK_FARM' heuristic. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the ML classifier output strongly indicate malicious intent, likely related to phishing or redirecting users to malicious content. No scripts were extracted, but the extensive link farm suggests a content-luring or redirection mechanism.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://tizup.armquiz.com/uploads/2020/01/28/bolozudotelovo_tekigejowudux_lifigofoxidega_tijunirosod.pdf
    • http://thepinstation.com/uploads/1/3/0/2/130287735/b6cbf1b8c.pdf
    • http://xib.estiny-studio.ru/uploads/2020/01/28/01f9b82769202c3.pdf
    • http://tad.spadesign.ru/uploads/2020/01/28/rirunatup-bujarona-vegopup-gujexuwek.pdf
    • http://wiwu.pcash.fun/uploads/2020/01/28/7119327.pdf
    • http://buwiwoso.right-style.ru/uploads/2020/01/28/9485227.pdf
    • https://xubowijuzadoje.weebly.com/uploads/1/3/0/5/130589115/poxamomolodete_nivezenizijux_bubatun.pdf
    • http://bonviewmodern.com/uploads/1/3/0/3/130379123/0accf5fc3ccfb1d.pdf
    • http://allergy.mediutopia.com/uploads/1/3/0/3/130323175/130323175.html#the+history+of+seventh+day+adventist+pdf
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000012e6.bin
c7c2091dc8f63abd7d496d01577d085f9b114db7d1aecdcd155abe1243311679		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12E6 8976 bytes
font_01_sfnt_off0000d637.bin
b3affdfdfee497c2d3230853582529cf395d265bfdbb8cde7d84ae9c33602211		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD637 16036 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.