Malicious PDF — malware analysis report

Static analysis result for SHA-256 9061e5b6ea7f3c75…

MALICIOUS

PDF

52.4 KB Authoring application: PDFedit
MD5: bef4bcb957c9fc3ac169a63a1bcbfd34 SHA-1: a6268149d51cae64f840f618d9f35658e206bf6e SHA-256: 9061e5b6ea7f3c75dff4a102056b8eefffdd0a92e20d5dd267fffa988af6b927
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF was flagged by ClamAV as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and a machine learning classifier indicated a high probability of maliciousness. The primary heuristic firing, 'PDF_SEO_LINK_FARM', indicates the document contains a large number of external links, with the first identified URL being http://vegasvoicelessons.com/uploads/1/3/0/6/130621901/6069643.pdf. This suggests the PDF's purpose is to redirect users to other potentially malicious sites or content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9986

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://vegasvoicelessons.com/uploads/1/3/0/6/130621901/6069643.pdf
    • http://narrativecounseling.com/uploads/1/3/0/6/130639385/vobobuw.pdf
    • http://plaksi.digital/uploads/2020/01/28/713f93.pdf
    • http://soleiltranslation.com/uploads/1/3/0/6/130621294/7683595.pdf
    • http://chocny.com/uploads/1/3/0/6/130620353/1208397.pdf
    • https://romalaweg.weebly.com/uploads/1/3/0/4/130489020/kujebafi-sinepid-napubaxigike.pdf
    • http://2bobpoker.com/uploads/1/3/0/6/130639027/lurobifipufu.pdf
    • http://juliejesternewman.com/uploads/1/3/0/4/130490561/130490561.html#information+about+taj+mahal+in+urdu

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000131c.bin
0beaed5d91bc2bfe089da8231cfe7041dab87f523b7262e2776197f0954a4b4e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x131C 9188 bytes
font_01_sfnt_off00006515.bin
4cda5f785b161ab6df9682e6368fd2c101e9aa902a3f31947a361fc50cf1a95c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6515 2732 bytes
font_02_sfnt_off00006e17.bin
005192ca0810ddb512529388509fac5cd2942a212039e49fd0c5f3c1c9800425		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6E17 6808 bytes
font_03_sfnt_off00007fc3.bin
0406d03b2d79a9d4c7b26da6767c19e49a6fa6abc3310d0be1160893db3b2bc9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7FC3 18008 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.