Malicious PDF — malware analysis report

Static analysis result for SHA-256 7a0a9f007f84ac23…

MALICIOUS

PDF

68.1 KB Authoring application: GIMP
MD5: ac5ebe9e1864691806ece031c9a612c2 SHA-1: d0e67ee9f612ddeffc764584a8affd4fe43e1f12 SHA-256: 7a0a9f007f84ac231fa0a90753b697c47008c58b6a02ce8c101762300fd0e7a3
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded external links, a technique often used for SEO spam or to distribute malicious content. ClamAV detected this as 'Pdf.Phishing.TtraffRobotInstall-7605656-0', indicating a phishing or malicious redirection attempt. The ML classifier also strongly flagged this PDF as malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9982

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://myexpatsipp.com/uploads/1/3/0/4/130488850/kokekokabamevajuzip.pdf
    • http://baudlbears.com/uploads/1/3/0/5/130551418/8539085.pdf
    • http://theperfectera.com/uploads/1/3/0/4/130476454/duzedomaxuxexedur.pdf
    • http://photos.clairerenaud.com/uploads/1/3/0/7/130776572/jofiwekobiwoti_fewufin_desimezi_tidubad.pdf
    • http://jeffdanielsofficial.com/uploads/1/3/0/7/130775715/lawagejedoxilopa.pdf
    • http://africanretreats.com/uploads/1/3/0/8/130813818/6673428.pdf
    • http://www.newyoukungfu.com/uploads/1/3/0/7/130776123/kasisadudujabu.pdf
    • http://qwestllc.com/uploads/1/3/0/4/130490277/sirudabiputim-kidivitugoruj-zazubekezizama.pdf
    • http://delfinocarrasco.com/uploads/1/3/0/6/130605040/eed3b1a38.pdf
    • http://www.bikefishski.com/uploads/1/3/0/3/130324063/3248820.pdf
    • http://steelbullets.com/uploads/1/3/0/7/130739871/xemadinazi.pdf
    • http://1sx.brdge.org/uploads/1/3/0/5/130588906/130588906.html#manorama+gk+book+2018+pdf+free+download
    • http://fedorahosted.org/lohit
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License
    • https://savannah.gnu.org/projects/freefont/
    • http://www.gnu.org/licenses/
    • http://www.gnu.org/copyleft/gpl.html

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000632b.bin
f99dfb4b979192f02fa23c462f1d58823d2463fb78640dec1062e155f1952dba		 pdf-font-stream PDF embedded font (sfnt) at offset 0x632B 16088 bytes
font_01_sfnt_off00007793.bin
1723f1ced37cc89d69e30f3df6281c5e5fb8989544fd4587aa75b00c91af2fd0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7793 1388 bytes
font_02_sfnt_off0000825e.bin
42b7a032782ef2f48d8cc0d13eb1f13b08d80957a3392b0d844bf148c4c2d12b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x825E 18628 bytes
font_03_sfnt_off0000b405.bin
330de7cea57980ab80bac2a26efa6dad88cda6702b5686567bc033f1e5dccc04		 pdf-font-stream PDF embedded font (sfnt) at offset 0xB405 8152 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.