Malicious PDF — malware analysis report

Static analysis result for SHA-256 701ef3c78706ed18…

MALICIOUS

PDF

40.2 KB Authoring application: Smallpdf Desktop
MD5: 6e5ff4e6a8f65515578c82178f94d537 SHA-1: 26b48a5363fc9808158d6f761d7fdd560d53fac4 SHA-256: 701ef3c78706ed188265ac7eb31701856c506e2ca3690a4d599f48897ff39df3
192 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF file exhibits characteristics of a phishing lure, indicated by the presence of a large number of external links and a ClamAV detection for 'Pdf.Phishing.TtraffRobotInstall'. The document body, though heavily corrupted, suggests it might be part of a scheme related to software cracking tools, further supporting a malicious intent. The embedded URLs are likely used to distribute further malicious content or redirect users to phishing sites.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://bejeg.kapli-molot-tora.info/uploads/2020/01/27/1e29f4974a7.pdf
    • http://zeparo.fuse0000.online/uploads/2020/01/27/3889.pdf
    • http://valkrystore.org/uploads/1/3/0/4/130435574/6692631.pdf
    • http://drfinkhobart.com/uploads/1/3/0/3/130379081/7972485.pdf
    • http://nitesukogi.fotostr.ru/uploads/2020/01/28/zewuzeludoxetemij.pdf
    • http://stefanosgarbi.weebly.com/uploads/1/3/0/5/130543134/320d12ce.pdf
    • http://abthic.weebly.com/uploads/1/3/0/4/130476671/wefejapuguza.pdf
    • http://staplesseniorbenefits.com/uploads/1/3/0/5/130541327/1061399.pdf
    • https://jufegojero.weebly.com/uploads/1/3/0/2/130288316/6562982.pdf
    • http://miles-of-trees.org/uploads/1/3/0/3/130323556/f51c127fe547.pdf
    • https://bojamebe.weebly.com/uploads/1/3/0/5/130542866/9409d.pdf
    • http://mepalparish.org/uploads/1/3/0/6/130620282/53cefe39bfecb6.pdf
    • http://karinkashmieklund.com/uploads/1/3/0/6/130621220/4401299.pdf
    • http://atimer.net/uploads/2020/01/27/1c959ee.pdf
    • http://dipiudesign.eu/uploads/1/3/0/2/130289222/6353516.pdf
    • http://notesfromapractice.com/uploads/1/3/0/5/130551483/9339c0b01df1.pdf
    • http://carbonneutralshef.weebly.com/uploads/1/3/0/4/130489081/xakuraxo-bukirepegeri-jawulupezugotit.pdf
    • http://deillusionist.ru/uploads/2020/01/27/53f2c96bb74603f.pdf
    • https://napixaxabep.weebly.com/uploads/1/3/0/2/130271224/dekerifojot-sodezejar.pdf
    • http://miracleinabucket.com/uploads/1/3/0/4/130476062/130476062.html#miracle+box++for+android

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001570.bin
c1485c33501522bc872a18329ed5ff317f7294d7a018b135f774dbdbe8c4c91d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1570 8076 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.