Malicious PDF — malware analysis report

Static analysis result for SHA-256 72d8a3b8270d2011…

MALICIOUS

PDF

38.6 KB Authoring application: ImageMagick
MD5: 83dcb4baa477af922bf9e4ce6f730ad8 SHA-1: b40d0af55de622b2a3821dd451c2ce5ab767d364 SHA-256: 72d8a3b8270d201125446717410487aa09b005ea8906cfaa6108ee314ab2bdab
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded URLs pointing to external PDF files, a technique often used for SEO spam or to distribute malicious content. ClamAV identified this as 'Pdf.Phishing.TtraffRobotInstall-7605656-0', indicating a phishing or traffic redirection intent. The ML classifier also strongly flagged this as malicious. The document body itself is heavily corrupted but contains some of the same URLs found in the heuristics.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://wovuloz.napolka174.ru/uploads/2020/01/27/jadezux.pdf
    • http://whatischaga.com/uploads/1/3/0/5/130540567/junajaxozameve-meragowuforewu-werepevogodonop-gibafito.pdf
    • http://channelthestar.com/uploads/1/3/0/5/130551248/migalugulegexaz_puber_sivebut.pdf
    • http://36east7thcincinnati.com/uploads/1/3/0/6/130604421/rirobo.pdf
    • http://olivetreecookeryschool.weebly.com/uploads/1/3/0/6/130620478/662238.pdf
    • http://1stpage.co.nz/uploads/1/3/0/2/130289240/waletumakarajib-mazovolelojiji-zedudaz-foboxavu.pdf
    • http://balance4yourlife.com/uploads/1/3/0/2/130289663/segixuwokiwu-wojime.pdf
    • http://bosemawo.virtlove.fun/uploads/2020/01/28/pirusabalijikot-vovabes-jukeb-xilasidetogo.pdf
    • http://amartvn.com/uploads/1/3/0/5/130590777/0e3962a596.pdf
    • http://controlledwatersolutionz.com/uploads/1/3/0/5/130589006/warofijetebozi-xitejowim-joxabuki-givekir.pdf
    • http://naka-g.creps-inc.jp/uploads/1/3/0/4/130435939/4671343.pdf
    • http://101taiwantour.com/uploads/1/3/0/4/130490155/9677025.pdf
    • http://your-aroma.co.uk/uploads/1/3/0/6/130620958/2555963.pdf
    • http://416206794898212488.weebly.com/uploads/1/3/0/6/130604413/01a89c0b8a8dd.pdf
    • http://americanlandscapingservice.com/uploads/1/3/0/4/130477605/3103214.pdf
    • http://mnguidedgoosehunting.com/uploads/1/3/0/3/130323914/zitivezelulid_nanotu.pdf
    • http://stokesed508webpage.com/uploads/1/3/0/6/130621218/130621218.html#acs+acute+coronary+syndrome

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000156c.bin
fad7f08f84f92f1f072bce48a28fff28d656b15113118e71bf1c8b8ce63e8c39		 pdf-font-stream PDF embedded font (sfnt) at offset 0x156C 7728 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.