Malicious PDF — malware analysis report

Static analysis result for SHA-256 733da55f558f5b7c…

MALICIOUS

PDF

57.4 KB Authoring application: Poppler-utils
MD5: 9e6d6c98053b9e7bb12603a535d2288c SHA-1: e92c53c97a0f9b1359ac4caccba5efd7b9617cf3 SHA-256: 733da55f558f5b7cbd55db91bc252d4663bd1a6942f2c33e18af4a554a1cb32f
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF file was flagged by ClamAV as Pdf.Phishing.TtraffRobotInstall-7605656-0 and a machine learning classifier. The PDF contains a large number of embedded external links to other PDF files hosted on various domains, suggesting a link farm or phishing campaign. The document body text is heavily corrupted, but the presence of embedded URLs and the heuristic firings strongly indicate a malicious intent to redirect users to potentially harmful content.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://dibot.espressoplanner.com/uploads/2020/01/29/8782017.pdf
    • https://tabivuxu.weebly.com/uploads/1/3/0/5/130539092/2656501.pdf
    • http://nevetelefa.friendlylazur.com/uploads/2020/01/27/sobig.pdf
    • https://fadenewenolum.weebly.com/uploads/1/3/0/6/130603931/08af4.pdf
    • http://speacetech.us/uploads/2020/01/27/4318272.pdf
    • http://vegujo.pinhs-ap.com/uploads/2020/01/27/170532.pdf
    • https://xuwijugikukimo.weebly.com/uploads/1/3/0/2/130274088/ligipudifabus.pdf
    • https://lirujezitun.weebly.com/uploads/1/3/0/6/130604040/9d585b5c7c89.pdf
    • http://michelleveixmccartan.com/uploads/1/3/0/4/130483626/mosoxe.pdf
    • https://mezesawe.weebly.com/uploads/1/3/0/6/130604595/1026240.pdf
    • https://weliwonilubo.weebly.com/uploads/1/3/0/3/130323156/pasevuzojexu.pdf
    • http://dansemonteregie.com/uploads/1/3/0/4/130435833/85e83c8a.pdf
    • http://naruseclimbingschool.weebly.com/uploads/1/3/0/6/130639578/nerosupumezokijelafo.pdf
    • http://xugelax.naaltae.ru/uploads/2020/01/29/3079854.pdf
    • http://fb-sale.ru/uploads/2020/01/28/govikadusuf.pdf
    • http://cdc-tmsolutions.co.uk/uploads/1/3/0/5/130550972/0650423cf5.pdf
    • http://linkwestapt.com/uploads/1/3/0/4/130483540/bilugoxerure_rupega_basesipifim.pdf
    • http://dofumupa.denem3131.com/uploads/2020/01/28/napojofajawu.pdf
    • http://xar.oklkab.ru/uploads/2020/01/27/9395693.pdf
    • http://a1412531xstreamtravel.xsideas.com/uploads/1/3/0/6/130603906/130603906.html#libro+actos+de+fe+pdf+gratis

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000014b6.bin
060fbfd92f9f51d66c508c154fa4376889a51449ee0cd66349d5e4497ee16d81		 pdf-font-stream PDF embedded font (sfnt) at offset 0x14B6 9688 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.