Malicious PDF — malware analysis report

Static analysis result for SHA-256 7f6d47384137a042…

MALICIOUS

PDF

47.1 KB Authoring application: Mobipocket Creator
MD5: 293dbb9e9c71b1c05bb10d3777960148 SHA-1: e07396b56d674e10b87a499d4adc48b3331fefe7 SHA-256: 7f6d47384137a0420996c4cb01baa9cf0e476343752988271175c9e74d54f1e1
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of embedded external links, a technique often used for SEO manipulation or to redirect users to malicious sites. ClamAV detected this as 'Pdf.Phishing.TtraffRobotInstall-7605656-0', and a machine learning classifier also flagged it with high confidence. The document body itself is largely obfuscated but contains references to cello sheet music and several URLs that appear to be part of a link farm.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://calvaryslofamilies.com/uploads/1/3/0/2/130288363/rilemuwinos-voratesu-luguvej-mupuzajufutane.pdf
    • http://nicoleforcouncil.com/uploads/1/3/0/5/130543682/lotaselaxezal.pdf
    • http://vajo.baksmans.club/uploads/2020/01/28/zotanowaxavakevivos.pdf
    • http://eykx.com/uploads/1/3/0/3/130313657/robul.pdf
    • http://bitcoinserv.co.uk/uploads/1/3/0/6/130620890/265153.pdf
    • http://thejohnv.studio/uploads/1/3/0/4/130476984/2977bf5988e.pdf
    • http://karinjohansson.net/uploads/1/3/0/6/130604433/5d72ff460531.pdf
    • http://carpetcleancary.com/uploads/1/3/0/4/130488512/130488512.html#cello+sheet+music
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001181.bin
939ca559b4ea3fc1b01bd177ea2b16444ce882fc45cf6b20126ab44ea0bdca50		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1181 8840 bytes
font_01_sfnt_off0000725c.bin
6db2f878e0fd57d3a351d0d81a5ccd7b58f68df6728dadc3aee3ebeb1a1d6e60		 pdf-font-stream PDF embedded font (sfnt) at offset 0x725C 16068 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.