Malicious PDF — malware analysis report

Static analysis result for SHA-256 943aa62590d23186…

MALICIOUS

PDF

33.8 KB Authoring application: SWFTools
MD5: 2fc4edd8a2a23e0cc27bcdc0f21502d4 SHA-1: d705332a736b9aba066331840236da45361c339b SHA-256: 943aa62590d2318617d9283364777bf8c2915ef08c2b4ebc4fb200e53d2ea0f5
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded external links, as indicated by the PDF_SEO_LINK_FARM heuristic. The ClamAV detection and ML classifier also flag this file as malicious, specifically identifying it as a phishing or traffic-generating PDF. The primary attack pattern involves directing users to a multitude of external PDF resources, likely for malicious redirection or SEO spam.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xofupupivi.weebly.com/uploads/1/3/0/5/130588931/tinevujasoxa-nowukanorifik.pdf
    • http://tiru.fito-spray-ellada.online/uploads/2020/01/28/vimusitid.pdf
    • http://fuzar.globewebguru.com/uploads/2020/01/28/1f5ff5b142c8992.pdf
    • https://zabitoje.weebly.com/uploads/1/3/0/4/130476502/senoju.pdf
    • https://kefegujivetixo.weebly.com/uploads/1/3/0/4/130435639/9715f95e7d1.pdf
    • https://fatixebo.weebly.com/uploads/1/3/0/6/130604606/7579c6658ef9b.pdf
    • http://vinubed.comunicazionequantistica.com/uploads/2020/01/27/5239707.pdf
    • http://lujovem.zagruzka7km.com/uploads/2020/01/28/415951.pdf
    • http://mim.onkologinet.ru/uploads/2020/01/27/da0eb885fcdd5a.pdf
    • https://pudevasave.weebly.com/uploads/1/3/0/2/130272242/bc3e734.pdf
    • https://sowowufakumoju.weebly.com/uploads/1/3/0/6/130604456/130604456.html#nominative+accusative+dative+pronouns+german

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000123b.bin
9deda41d20564f45a9569d29d7fe9124045f9d109084df9495fd4a9c80eead62		 pdf-font-stream PDF embedded font (sfnt) at offset 0x123B 8384 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.