Malicious PDF — malware analysis report

Static analysis result for SHA-256 73c8a5935ab38334…

MALICIOUS

PDF

68.9 KB Authoring application: Adobe PDF Library 9.0
MD5: 91c6d2e4db31e3d893721e7286bac26e SHA-1: a44a5783311d989ca5a1c19e94c6e249e4ef2fbd SHA-256: 73c8a5935ab38334e1604c14f5ccd6212c4434465b96664425f4e268492f691f
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. The ClamAV detection as Pdf.Phishing.TtraffRobotInstall-7605656-0 and the ML classifier output strongly suggest malicious intent. The primary attack pattern involves directing users to a multitude of external PDF resources, likely for malicious redirection or SEO spam.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://rurostelekomk.ru/uploads/2020/01/27/nukibixozaduwi.pdf
    • http://vijariwu.salonhm.net/uploads/2020/01/28/cb30c2e212e3.pdf
    • http://tesekadap.tdorestoran.ru/uploads/2020/01/27/1167520.pdf
    • https://busufovemawut.weebly.com/uploads/1/3/0/4/130483184/dadawivef-kebobura-kavubozit.pdf
    • http://4gkingdomliving.com/uploads/1/3/0/6/130620689/kenulijubaja.pdf
    • http://mexicolegalhelp.com/uploads/1/3/0/6/130622116/bodalenupofez_tovelef.pdf
    • http://muwazus.helpsinstagram.com/uploads/2020/01/28/1694193.pdf
    • http://merryhillweddings.net/uploads/1/3/0/6/130639530/2042582.pdf
    • http://mrandmrsmusicco.com/uploads/1/3/0/2/130289154/vorobuvagit.pdf
    • http://fassil.online/uploads/2020/01/28/dokobibeb_jakanuwesesular_tezotipisit.pdf
    • http://gereku.sunparkspb.com/uploads/2020/01/27/4605433.pdf
    • https://pumugutan.weebly.com/uploads/1/3/0/2/130291596/rowaxeruvam.pdf
    • http://suor.pt/uploads/1/3/0/5/130550844/1259281.pdf
    • https://mojebuxarijewa.weebly.com/uploads/1/3/0/5/130589297/1b51ac81d60d.pdf
    • http://numo.scinote.ru/uploads/2020/01/29/4323475.pdf
    • http://mmjplantation.org/uploads/1/3/0/5/130539366/zixoluruwokaz.pdf
    • http://simexomu.digitalein.com/uploads/2020/01/28/1110877.pdf
    • http://50lutions.net/uploads/2020/01/27/zivobupaz_nojotugizizujo.pdf
    • http://fovepexiwo.rucrime.top/uploads/2020/01/29/97eef354bc.pdf
    • http://vabe.partizansk-vc.ru/uploads/2020/01/29/fafomaboze_wodanodukebi_favunutan.pdf
    • http://ayurvedicprinciples.com/uploads/1/3/0/6/130621836/sotugibizux-juxubi-fijoxewof.pdf
    • http://8danaroad.com/uploads/1/3/0/5/130588956/b79e761bacd4e.pdf
    • http://flexbeat.pro/uploads/2020/01/28/aa27f85e.pdf
    • http://qslam.com/uploads/1/3/0/6/130604340/2933361.pdf
    • http://oakislandhomeowners.org/uploads/1/3/0/3/130313634/130313634.html#bootstrap+material+design+dashboard+template
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000017f3.bin
508958f77dc81aa2eb33a921cc68b65eaebc04e334f8ff23645a44170141bcd9
pdf-font-stream PDF embedded font (sfnt) at offset 0x17F3 8708 bytes
font_01_sfnt_off0000c74c.bin
669a22844ddb84b64a1d93eb6147c2b8b7ca76f4316fe4be2bbf69c96252e72a
pdf-font-stream PDF embedded font (sfnt) at offset 0xC74C 16180 bytes