Malicious PDF — malware analysis report

Static analysis result for SHA-256 79e707b282a01af5…

MALICIOUS

PDF

31.2 KB Authoring application: GIMP
MD5: a6d9e43ca2dadcc5a77405792d1118cf SHA-1: ae24d67c9213655e00543e7ac43ac9825a8cc9a0 SHA-256: 79e707b282a01af5c0e6ebb9288a0c98fd4344980b33161aafcc40c915ab4023
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded URLs, identified by the PDF_SEO_LINK_FARM heuristic, suggesting a link farm or distribution mechanism. The ML classifier and ClamAV detection strongly indicate malicious intent, specifically classified as phishing. While no scripts were extracted, the embedded URLs are the primary indicators of compromise, likely leading to further malicious content or phishing pages.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://bidosu.care-store.ru/uploads/2020/01/29/7998c0bdf91.pdf
    • http://femi.rapmo.ru/uploads/2020/01/27/2115502.pdf
    • http://regukuze.copyrightcontact-1000006412512.com/uploads/2020/01/28/kiwabirafiridi.pdf
    • http://wisemoneystrategies.com/uploads/1/3/0/5/130544547/fiwuse.pdf
    • http://sidemountainspecialtyfoods.com/uploads/1/3/0/5/130543945/bikugozafuzun-taragix-kapukipudog-pozozezopexalav.pdf
    • http://mova.digiproduct.org/uploads/2020/01/28/pukafogaga.pdf
    • http://zumiw.autocivilka.site/uploads/2020/01/27/rexoxago_tegukefonosapu_kutipot.pdf
    • http://vertudevelopment.com/uploads/1/3/0/5/130590671/konadakix-pivetisabega-nozopa.pdf
    • http://ravumat.cobratech.ru/uploads/2020/01/27/4e061ea74f13460.pdf
    • http://sevoparis.fr/uploads/1/3/0/5/130589020/3586186.pdf
    • http://novaimmobilien.eu/uploads/1/3/0/6/130620370/48740.pdf
    • http://psupostdoc.org/uploads/1/3/0/6/130603704/sanagufimojatefuz.pdf
    • https://witasumezuwodon.weebly.com/uploads/1/3/0/2/130287837/9209284.pdf
    • https://fiwokotiribow.weebly.com/uploads/1/3/0/6/130604522/zunofepaju.pdf
    • http://pinjabruun.com/uploads/1/3/0/2/130287977/7935211.pdf
    • http://ankezimmermann.ca/uploads/1/3/0/4/130475997/130475997.html#rock+falling+sound+effect+free

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000013ed.bin
a9740bc611c2ea4e4581814a9f277b1406c3ff0caa7ac5f7588abd9b55b95901		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13ED 7532 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.