Malicious PDF — malware analysis report

Static analysis result for SHA-256 8f0d09e8b94b9a2e…

MALICIOUS

PDF

39.6 KB Authoring application: PDFedit
MD5: c142bfe981200025202853371ba2a915 SHA-1: 2a9084c88146a724fd2a06d5fdd878e207e5940b SHA-256: 8f0d09e8b94b9a2e5b0b8b1aba4b0a7b59ae5620bdfcaa6f9bd85f1b158d6090
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded URLs, identified by the PDF_SEO_LINK_FARM heuristic, suggesting a link farm designed to distribute malicious content or phish users. ClamAV detection as Pdf.Phishing.TtraffRobotInstall-7605656-0 further supports the malicious nature. The ML classifier also strongly indicated maliciousness. The document body contains garbled text, indicating it is not intended for human consumption but rather as a container for the malicious links.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://rowigokoke.atimer.net/uploads/2020/01/28/pubejunimar.pdf
    • https://bofutazi.weebly.com/uploads/1/3/0/5/130545800/027b26726.pdf
    • http://agl-llc.com/uploads/1/3/0/2/130289603/7128143.pdf
    • http://theempoweredyou.com/uploads/1/3/0/4/130488228/5932674.pdf
    • http://five-words.org/uploads/1/3/0/6/130605125/9122728.pdf
    • http://sumiva.pknovitek.ru/uploads/2020/01/27/e4ce91ac14bbd4.pdf
    • http://lansingweddingdjs.com/uploads/1/3/0/4/130483514/serupaxatikabu_rizobesuwevin_weliborugamu.pdf
    • http://popekoju.blendsa.com/uploads/2020/01/27/6769217.pdf
    • http://buxe.gost-stroy.com/uploads/2020/01/27/revanelavepa.pdf
    • http://tahoetimbersledtours.com/uploads/1/3/0/6/130622053/130622053.html#achilles+tendon+painful+in+the+morning

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000011e0.bin
21d6bdef7179eed09578ddbea137a73035e620aa8b86e3cb36204e0c2bdfdf6e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11E0 7528 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.