Malicious PDF — malware analysis report

Static analysis result for SHA-256 792732c43b903e09…

MALICIOUS

PDF

37.8 KB Authoring application: Poppler-utils
MD5: 91aaf64b2037289c7041caa3a3e900c2 SHA-1: 95d4b74dbfb0b578767150ac032f046a3dec4116 SHA-256: 792732c43b903e09177e84f34fca23a72706c1c31402d0d170266d489292dd13
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded URLs pointing to external PDF files, a technique often used for SEO spam or to redirect users to malicious content. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the ML classifier output strongly indicate malicious intent. While no scripts were explicitly extracted, the PDF structure and embedded URLs suggest a phishing or redirection attack.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://duferudu.jetblue-air.com/uploads/2020/01/29/6268cb9a.pdf
    • http://official-brands.com/uploads/1/3/0/5/130590036/554080.pdf
    • http://animspree.com/uploads/1/3/0/4/130435947/e514a1f3.pdf
    • http://nwuu.org/uploads/1/3/0/5/130589281/joruvitezejop.pdf
    • http://supercoolertechnologies.com/uploads/1/3/0/5/130590158/8198507.pdf
    • http://mrsbalisalisa.com/uploads/1/3/0/6/130605167/5412890.pdf
    • http://blackburnmarketers.com/uploads/1/3/0/4/130476649/b44e5db3e0ca81.pdf
    • http://vokowaw.muaxehoigiatot.com/uploads/2020/01/27/6d2f704c.pdf
    • http://mrsneuville.com/uploads/1/3/0/5/130550826/mofaxezabikuru.pdf
    • http://noxakeseb.digiproduct.org/uploads/2020/01/29/4896065.pdf
    • http://njetd.com/uploads/1/3/0/3/130379098/sazip_gexefi_zezit.pdf
    • http://famo.kuhnimsc09.icu/uploads/2020/01/27/geribigunos-fapagorepeg.pdf
    • http://vepowe.the-future-company.com/uploads/2020/01/28/baxuwiwojur-wegigu-mixiz-budopizidajo.pdf
    • http://smpcreditrepair.org/uploads/1/3/0/4/130483508/b749bf63e4f.pdf
    • https://fekanonuketi.weebly.com/uploads/1/3/0/5/130544136/nepabivipu.pdf
    • http://konrn.com/uploads/1/3/0/5/130540146/0a4e25.pdf
    • http://nangginkui.com/uploads/1/3/0/5/130550657/5063d5a.pdf
    • http://sossanantonio.com/uploads/1/3/0/5/130551141/5ced540.pdf
    • http://bibaandboba.info/uploads/2020/01/28/9298986.pdf
    • http://cecilyeiferle.com/uploads/1/3/0/5/130590287/130590287.html#ardaas+karan+movie+all+songs

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001568.bin
f20e1ce2cd8d6cd43712885e393f123b7a9eed3372c2e8ba7eb2bf039261da7c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1568 8356 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.