Malicious PDF — malware analysis report

Static analysis result for SHA-256 7d67b95b11c4decb…

MALICIOUS

PDF

42.8 KB Authoring application: GIMP
MD5: b592e10f785c538e6aecd5749c633b75 SHA-1: d624efdf91bcee7e11e5d9b1e2111d50f4c902af SHA-256: 7d67b95b11c4decbb3f08083a19db391ab94d0d7ca7ea3bbd88a9a4f39344963
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded URLs pointing to other PDF files, indicating a link farm likely used for SEO manipulation or to distribute malicious content. ClamAV detected this as Pdf.Phishing.TtraffRobotInstall-7605656-0, and a critical heuristic fired for a PDF SEO link farm. The embedded URLs are the primary IOCs.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://libertybelleconcierge.com/uploads/1/3/0/3/130324004/wagoxoboxalik-xafusofosaj-simeduwetuz.pdf
    • http://100blackmen-stl.com/uploads/1/3/0/6/130605173/fifesufirejapix_duxonetenes_nadejiv_litekojakuxu.pdf
    • http://gavakix.difmed.com/uploads/2020/01/28/8796761.pdf
    • http://nogo.igorlucshii.online/uploads/2020/01/28/lolesozofevi-jelemep-bufanof-zinif.pdf
    • http://zepefix.myopros.tech/uploads/2020/01/28/e95c3c146a.pdf
    • http://officermnop.com/uploads/1/3/0/5/130543010/zopawiresepilatud.pdf
    • http://dishingitupgame.net/uploads/1/3/0/6/130604288/jijijaguwulo.pdf
    • http://thomasvasasphotography.shop/uploads/1/3/0/5/130588575/527244.pdf
    • http://kathleenmaree.com/uploads/1/3/0/2/130288391/2235390.pdf
    • http://tutorvirginia.com/uploads/1/3/0/4/130477533/dutomizopa-vazekotiwupud.pdf
    • http://benkregel.com/uploads/1/3/0/5/130540725/130540725.html#oecd+education+2030+report

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001470.bin
d76dc870ce0db1e6d109d87ed2394b37ef4228c317a20db1f684c2ee60200904		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1470 8220 bytes
font_01_sfnt_off00006c4b.bin
ff90f76a01ccf9878a1088387a2b8e448e7dda08b241d7f0eb31b769938d48cf		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6C4B 2628 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.