Malicious PDF — malware analysis report

Static analysis result for SHA-256 6ebdb5ae2977e6b5…

MALICIOUS

PDF

38.3 KB Authoring application: GIMP
MD5: 88a929cc2f798f07fb85c025948d8019 SHA-1: b4c6d8fe4cefc6e49392af9111de986e69c90ea4 SHA-256: 6ebdb5ae2977e6b56212a0bdb1850e166379f847273d3f7bc0c86c3d04726ff1
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of embedded URLs, forming a link farm, which is a common tactic for phishing and distributing malware. The document body text, though partially corrupted, mentions downloading Adobe Acrobat Reader, suggesting a lure to trick users into downloading a malicious file. The ClamAV detection and ML classifier further confirm its malicious nature.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://luvaxiduw.weebly.com/uploads/1/3/0/3/130313179/nidopoxuduxipaj-jodirize-kunogifanuzo.pdf
    • http://arkansasartpottery.com/uploads/1/3/0/3/130379431/6be7b09ad04d.pdf
    • http://revolution-coffee.net/uploads/1/3/0/6/130605010/mamoraxup-vepetenose-bowifodika.pdf
    • http://metroprointeriors.com/uploads/1/3/0/4/130435762/keduwebemun-wepunedevisawi.pdf
    • http://book-support.info/uploads/2020/01/28/rebafiginovofir.pdf
    • http://surfsideplayhouse.net/uploads/1/3/0/4/130488694/5984c.pdf
    • http://modernyogiwisdom.com/uploads/1/3/0/4/130483649/ff7589c.pdf
    • http://mymaxtax.com/uploads/1/3/0/5/130589214/jeraderajoram.pdf
    • http://sochi-ses.ru/uploads/2020/01/28/8769438.pdf
    • http://directinservicetraining.com/uploads/1/3/0/5/130588595/xugapexotude_salejo.pdf
    • http://nuobeijing.devsite-1.com/uploads/1/3/0/6/130604321/130604321.html#free+download+adobe+acrobat+reader+software+for+windows+7

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000012c9.bin
1969c8fc53312cc71d64aa5b323a97d11c6b8c6ceb2464cb7af1ca09a3b46088		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12C9 7852 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.