Malicious PDF — malware analysis report

Static analysis result for SHA-256 732e5b232c0fa5bb…

MALICIOUS

PDF

48.8 KB Authoring application: SWFTools First seen: 2021-09-18
MD5: ab1b28c3d9257fb9b5b5c77ccdb7599f SHA-1: d9d005efba92e1203a190e57178cae45038acfff SHA-256: 732e5b232c0fa5bb48b4ab7583c5f9a3a35e0c921b4e7463bcbaf1856bc603c9
160 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. The document body, though heavily obfuscated, contains references to game cheats and URLs that are also listed as embedded URLs. This suggests a lure to drive traffic to external sites, potentially for SEO manipulation or to serve further malicious content, as indicated by the ClamAV detection and ML classifier.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 4

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Urgency / deadline lure low SE_URGENCY_LURE
    Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://razoxadibe.weebly.com/uploads/1/3/0/3/130313826/reviluv.pdf In PDF document text
    • https://vugenidova.weebly.com/uploads/1/3/0/4/130435835/pupufodi.pdfIn PDF document text
    • https://pekutagomuxive.weebly.com/uploads/1/3/0/3/130323375/401262.pdfIn PDF document text
    • https://jufegojero.weebly.com/uploads/1/3/0/2/130288316/gogej.pdfIn PDF document text
    • https://revajosojukeja.weebly.com/uploads/1/3/0/4/130436258/sekidolapej.pdfIn PDF document text
    • https://sikakebemi.weebly.com/uploads/1/3/0/4/130476859/8215757.pdfIn PDF document text
    • https://wajunamakizodes.weebly.com/uploads/1/3/0/4/130483138/c18f5819d40b0.pdfIn PDF document text
    • https://rufebegebe.weebly.com/uploads/1/3/0/2/130271143/130271143.html#car+cheats+for+gta+vice+city+ps2In PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001190.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1190 10020 bytes
SHA-256: 9e7e320e0965c842730dd9993b394bd97fc0e33020e9d169cbaef45373be8777

Open this report in the interactive analyzer, or submit your own file for analysis.