Malicious PDF — malware analysis report

Static analysis result for SHA-256 75045dd42367d744…

MALICIOUS

PDF

40.8 KB Authoring application: PDFedit
MD5: 683c9b55e73f03712c6cb43140bdfe3c SHA-1: 9e8c4055643530a70b02a0568d1a276cc807106f SHA-256: 75045dd42367d74498fa6f5ed01dfb196f27c13646f753a36378c5d9bea9e051
160 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of external links, many of which appear to be dynamically generated and lead to other PDFs. This behavior, combined with ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0', strongly suggests a phishing or scam campaign designed to redirect users to malicious content. The embedded URLs are likely used to host further stages of the attack or to distribute malicious files.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://myukpensiontransfer.com.au/uploads/1/3/0/2/130288334/mulew-pimupawemujezud-kaxibuja.pdf
    • http://ddsdelightsonline.com/uploads/1/3/0/2/130271108/fifukadekegulol-gavusitoti.pdf
    • http://synchronyled.us/uploads/1/3/0/7/130776641/lasuruwexabujevur.pdf
    • http://wastedtalentdesign.com/uploads/1/3/0/5/130551155/3e65fe49b09.pdf
    • http://crystalwittenutrition.com/uploads/1/3/0/6/130605505/f73782a6.pdf
    • http://wildwoodhome.shop/uploads/1/3/0/3/130312920/samib_goforin_volaxodewuveg_pobopaxexep.pdf
    • http://michaelaaftonjones.com/uploads/1/3/0/7/130739369/2413091.pdf
    • http://220-mail.256k.com/uploads/1/3/0/6/130621357/2409850.pdf
    • http://xutodes.store/uploads/1/3/0/5/130539554/gajakumuzun_mizedudezazop_jodexe.pdf
    • http://quick.beer/uploads/1/3/0/6/130621310/9299336.pdf
    • http://oilgasconsultinginc.com/uploads/1/3/0/4/130483491/aa53a0.pdf
    • http://www.southernmainetowing.com/uploads/1/3/0/6/130603834/9415664.pdf
    • http://adsl-63-204-18-30.benefitplans.org/uploads/1/3/0/2/130287296/130287296.html#how+to+increase+font+size+in+print+preview
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002e2d.bin
ff27d99f049fa5ec83b4c3710afe1f9aee00eb20942a9349d435d4ca5ad10f97		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2E2D 16388 bytes
font_01_sfnt_off00004697.bin
1144ca6f07ab3cacb9c8cdbe52a9fef540745e86c74a8c5ddd3af00d44900882		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4697 8168 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.