Malicious PDF — malware analysis report

Static analysis result for SHA-256 751ce49bba5e49aa…

MALICIOUS

PDF

41.3 KB Authoring application: PDFBox
MD5: c4d5a72860abd66fec07f88126e1f4cf SHA-1: 5d5ce3a33ab07f91dc29662b91298afcc845106a SHA-256: 751ce49bba5e49aaeadbbfd1688dff019573559b1938cdd8c726f112a8ac7109
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded URLs, identified by the PDF_SEO_LINK_FARM heuristic, pointing to external PDF files. This behavior is consistent with SEO spam or a mechanism to distribute further malicious content. ClamAV also detected this file as Pdf.Phishing.TtraffRobotInstall-7605656-0, reinforcing its malicious nature.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://mynaturalbliss.com/uploads/1/3/0/2/130272365/matijari_midujokaz.pdf
    • http://smpcreditrepair.org/uploads/1/3/0/2/130289504/aa815e80aa7b.pdf
    • http://veterinariagiada.com/uploads/1/3/0/6/130620624/tokitifomiro.pdf
    • https://tamufofaxedosul.weebly.com/uploads/1/3/0/4/130483537/2956273.pdf
    • http://nimanituk.myflowshop.com/uploads/2020/01/28/4069372.pdf
    • http://kuz.marusyatour.ru/uploads/2020/01/27/futax.pdf
    • http://tuva.canlisexhatti.online/uploads/2020/01/28/livadenopek.pdf
    • http://tutata.atvgorky.ru/uploads/2020/01/28/zujibuwevoz.pdf
    • https://tuzajepobavufe.weebly.com/uploads/1/3/0/5/130542934/7648911.pdf
    • http://msgavin34.weebly.com/uploads/1/3/0/2/130288577/218e5933951b8c9.pdf
    • https://ravufesagefoxi.weebly.com/uploads/1/3/0/6/130605107/d585da11c.pdf
    • https://jimagojuvupawod.weebly.com/uploads/1/3/0/3/130379083/makufamepezep.pdf
    • http://maturitas.ru/uploads/2020/01/28/tikomog_wupegix.pdf
    • http://cattailconstructionllc.com/uploads/1/3/0/3/130313049/digef.pdf
    • http://thefrogbunch.weebly.com/uploads/1/3/0/5/130546923/03f150159ee2b.pdf
    • http://poolbuild.ru/uploads/2020/01/27/84ac09a4.pdf
    • http://redeemingwretches.com/uploads/1/3/0/2/130272877/0508abdebd2.pdf
    • http://tradergreat.net/uploads/1/3/0/5/130588813/81f996ebc0f16.pdf
    • http://valleycharterhighschool.org/uploads/1/3/0/2/130289317/4370384.pdf
    • http://tate.betterqualityreviews.com/uploads/2020/01/28/bukexafagig.pdf
    • http://calvaryslofamilies.com/uploads/1/3/0/6/130620959/842fd.pdf
    • http://northamptonbluecommunity.org/uploads/1/3/0/2/130289618/kezewuzorexe-difivurodi.pdf
    • http://mksod.net/uploads/1/3/0/6/130621300/7550205.pdf
    • http://ctcphiladelphia.com/uploads/1/3/0/2/130289504/sakopufalasojir.pdf
    • http://vowu.evergy.ru/uploads/2020/01/28/3612623.pdf
    • http://mindforyou.org/uploads/1/3/0/3/130379583/130379583.html#joomla+3+templates+responsive+deutsch+kostenlos

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001968.bin
605d48e081d29df1e6a7b4a445f035d1e5c09670e41a726d9476cc0a8d632594		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1968 8940 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.