Malicious PDF — malware analysis report

Static analysis result for SHA-256 750b0bdc73b9035e…

MALICIOUS

PDF

38.0 KB Authoring application: Poppler-utils
MD5: af38c7911d5bb54a7e09d728a0a2f520 SHA-1: c71a234eda6c7c325454a7262e615831e37eb38a SHA-256: 750b0bdc73b9035e7dd5c097d3364601a7fce097050e7ce727448b3cfb93a531
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded URLs pointing to other PDF files, a technique often used for SEO spam or to redirect users to malicious content. ClamAV detected this as Pdf.Phishing.TtraffRobotInstall, indicating a phishing or traffic redirection scheme. While no scripts were explicitly extracted, the PDF structure and embedded URLs suggest an attempt to lead the user to external, potentially malicious, content.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://jabi.coachesportivo.com/uploads/2020/01/28/8d34bc67f53e8b.pdf
    • http://minzdravua.club/uploads/2020/01/28/6ecc17798414fb7.pdf
    • http://dazezalup.indmovieonline.club/uploads/2020/01/28/gitokimomuwuno_lirivekutes.pdf
    • http://gatas.fotografpaparaci.ru/uploads/2020/01/27/xibedosogazifeso.pdf
    • http://bimbasket.ru/uploads/2020/01/27/wapuruzoduxa.pdf
    • https://lesusida.weebly.com/uploads/1/3/0/6/130605289/bf198e.pdf
    • http://jupi.takprosto.club/uploads/2020/01/28/fijilufe-diranos.pdf
    • http://jedow.audiostart47.icu/uploads/2020/01/28/1157216.pdf
    • https://zipotitotij.weebly.com/uploads/1/3/0/2/130270967/jatukinenisosadi.pdf
    • https://filevarosebili.weebly.com/uploads/1/3/0/5/130589427/9678331.pdf
    • http://wuli.askaryan.com/uploads/2020/01/27/1603202.pdf
    • http://nupepeg.shoplife.xyz/uploads/2020/01/28/1122970.pdf
    • http://kof.trans-info.su/uploads/2020/01/28/gojigodosena-dibuninafitazo-pezoxogoli-kozakonila.pdf
    • http://applemann.ru/uploads/2020/01/27/ff5270.pdf
    • http://magovat.123game.pro/uploads/2020/01/27/tisigukupo.pdf
    • https://purowoladi.weebly.com/uploads/1/3/0/3/130324027/b14866.pdf
    • http://terudo.izdekreta.com/uploads/2020/01/28/tevupuxosilu-movevenopafuvu.pdf
    • http://vorefute.brazilplan.club/uploads/2020/01/28/fuwawexinakux_fapuwa_wenixuvibilo_guloxim.pdf
    • http://xisiro.aewjasw.icu/uploads/2020/01/28/rarevibatewaxov.pdf
    • https://vonuduxovo.weebly.com/uploads/1/3/0/3/130323709/5810953.pdf
    • https://jemejagukop.weebly.com/uploads/1/3/0/5/130590265/4d645393d8b790.pdf
    • https://gixaxilebo.weebly.com/uploads/1/3/0/2/130274241/b1e4f5d65f64c4c.pdf
    • https://rafilaluxonijew.weebly.com/uploads/1/3/0/4/130476150/130476150.html#acgme+case+log+system+down

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000165d.bin
cf4738d79b0ac0b28f81e9e6f95d62f22e72afad8327b5953d4f4ca92ba7c284		 pdf-font-stream PDF embedded font (sfnt) at offset 0x165D 8280 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.