Malicious PDF — malware analysis report

Static analysis result for SHA-256 79eda6c72346be5a…

MALICIOUS

PDF

39.3 KB Authoring application: pstoedit
MD5: f94e1f5a2cc08b8b33c0b8509fb72504 SHA-1: 895a0ec5d737694e7f57427971048c8dda077032 SHA-256: 79eda6c72346be5a41211de2abcb968e7dc69ef3999ff9b33e739f8e44440d1d
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links to external PDF files hosted on various domains, a technique often used for SEO manipulation or to distribute further malicious content. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the ML classifier output strongly indicate malicious intent. The document body, though heavily corrupted, contains references to 'Aafco labeling guidelines' which may serve as a lure.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://annaroseheaton.weebly.com/uploads/1/3/0/5/130544547/93398340b8b.pdf
    • http://andigeloolaw.com/uploads/1/3/0/5/130588202/06f19d166794fe.pdf
    • http://wavanuvox.novostroyki-barnaul.ru/uploads/2020/01/28/dinusofep-tewig-suxagazuwiboke.pdf
    • http://mightierthanswords.org/uploads/1/3/0/4/130477110/duxugax.pdf
    • http://viletago.zotye-t600.ru/uploads/2020/01/27/pavalazuparuju_jopomutapad.pdf
    • http://miskatonic-journal.ca/uploads/1/3/0/4/130483499/nagewepigod.pdf
    • http://punapa.themojo.ru/uploads/2020/01/27/vatakegupovowesa.pdf
    • http://pruittconsulting.org/uploads/1/3/0/6/130621642/9182444.pdf
    • http://metropolitaneprep.com/uploads/1/3/0/5/130551619/ruxokoduj.pdf
    • http://dunaecrenwelge.com/uploads/1/3/0/5/130539114/39c43b837b39dbc.pdf
    • http://pameladirnberger.com/uploads/1/3/0/6/130605492/130605492.html#aafco+labeling+guidelines

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000012b9.bin
cec79df1e4c3b579109a5a11da30ae07c3a8b6b14f9ef8266a86d8c1267a8f87		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12B9 8512 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.