Malicious PDF — malware analysis report

Static analysis result for SHA-256 791a93de7a8dd4c2…

MALICIOUS

PDF

41.2 KB Authoring application: ImageMagick
MD5: 002fd9325ab1f3c9a43a15b42c31cea8 SHA-1: 0abe1b3525f50b8f15c09fc7571c37ee1b8b661a SHA-256: 791a93de7a8dd4c20a655a8b45d315059b2dd611ed30971ea9b42b32706fd1aa
192 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded URLs, many of which point to other PDF files hosted on various domains. This behavior is indicative of a link farm designed to distribute malicious content, likely for phishing or malware delivery. The ML classifier and ClamAV detection strongly support the malicious nature of this file.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • PDF link to algorithmically-generated URL high PDF_RANDOM_URL_LINK
    PDF contains a clickable HTTP(S) link whose host looks algorithmically generated (pronounceable-random labels) and whose path/query carries a long high-entropy token. This is the randomized-redirector pattern of malspam phishing lures — the visible document is only a prompt — not a PDF parser vulnerability.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ottawahomefinders.com/uploads/1/3/0/6/130621367/5292427.pdf
    • http://peliw.bibaandboba.info/uploads/2020/01/27/62989c3ecec36.pdf
    • http://asdklo.xyz/uploads/2020/01/28/libawilunodox-xekinakubefo.pdf
    • http://mlhubbard.com/uploads/1/3/0/5/130589165/tazojo.pdf
    • http://nestedphoto.com/uploads/1/3/0/5/130550777/zixib.pdf
    • http://kelsrodandreel.com/uploads/1/3/0/5/130550836/02663f4f0.pdf
    • http://leregut.ale-sajgon.com/uploads/2020/01/28/befazukadupine_tazipijawu_pejomejovigab.pdf
    • http://turiwu.jila12.com/uploads/2020/01/28/nijezodijegete.pdf
    • http://gypsydenisse.com/uploads/1/3/0/2/130271085/1c728ee5.pdf
    • http://goronamike.west-lab.ru/uploads/2020/01/28/ad3b223ff3f5469.pdf
    • http://wenonitina.cafemostik.com/uploads/2020/01/28/5693550.pdf
    • http://lux.itraktor.ru/uploads/2020/01/27/dedinefu.pdf
    • http://racingshoxsweden.com/uploads/1/3/0/5/130550931/6679622.pdf
    • http://alinacruzfengshui.com/uploads/1/3/0/5/130588270/jibotizubux_tufizaduwida.pdf
    • http://strategicsolutionsint.com/uploads/1/3/0/6/130620797/toxedi_soxevixoku.pdf
    • http://nidinidi.com/uploads/1/3/0/5/130588182/nawameged.pdf
    • http://sculpturesrealty.com/uploads/1/3/0/2/130289509/5792506.pdf
    • http://montecristifinesouthamericanarts.com/uploads/1/3/0/4/130436137/4044121.pdf
    • http://rehphotography.org/uploads/1/3/0/5/130588798/130588798.html#pre+calculus+12+textbook+pearson+pdf

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000016ce.bin
b852cd5b57a69fc527b5e9f392123e3301545714534c283e80b497c99d1b4075		 pdf-font-stream PDF embedded font (sfnt) at offset 0x16CE 8556 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.