Malicious PDF — malware analysis report

Static analysis result for SHA-256 9621fed416bf1439…

MALICIOUS

PDF

39.6 KB Authoring application: Inkscape
MD5: abcb635eea2ac06f0a1a2bfbbcbe7c0f SHA-1: adf618f0d84b16a8be93dd912b57048f6384192e SHA-256: 9621fed416bf1439cd37ad9bf1a53e2a1f6c1d0f97342f25acbecfd533080081
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file was flagged by multiple heuristics, including a critical finding for a 'PDF_SEO_LINK_FARM' which indicates a large number of embedded external links. The ML classifier also assigned a high probability of maliciousness. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a phishing or malicious redirection intent. The embedded URLs, particularly the first one from 'greenwaystars.com', are likely part of this link farm.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://greenwaystars.com/uploads/2020/01/28/vobevufalo-dotoxabuse.pdf
    • https://nigudesamad.weebly.com/uploads/1/3/0/3/130379523/8936070.pdf
    • http://natashacorriephotography.com/uploads/1/3/0/6/130621072/9309672.pdf
    • http://lorahakanson.com/uploads/1/3/0/2/130292073/676cc4.pdf
    • http://theblockhousecafe.com/uploads/1/3/0/6/130604386/nowex-pewozib-fufegat-bonotix.pdf
    • http://moviestvsports.com/uploads/1/3/0/5/130590383/ee69704.pdf
    • http://ruefrancaise.com/uploads/1/3/0/4/130483978/ba47adf.pdf
    • http://myrachelnewman.com/uploads/1/3/0/6/130621370/680c0473822b570.pdf
    • http://wosuf.prosamoe.ru/uploads/2020/01/28/koropenebuwot-valekow-gagegupig-bopavokevesug.pdf
    • http://pawsandtaws.net/uploads/1/3/0/2/130289430/5497440.pdf
    • http://looe-festival-of-the-sea.com/uploads/1/3/0/5/130550663/4154ab913a367c2.pdf
    • http://mid-americathermalimaging.com/uploads/1/3/0/4/130488370/sulimeturasibe.pdf
    • http://clayrichard.com/uploads/1/3/0/4/130483770/gujivodubamubiv.pdf
    • http://percorsidarte.com/uploads/1/3/0/6/130639526/jivixobas.pdf
    • http://bellevueboysswive.com/uploads/1/3/0/6/130621850/4023387.pdf
    • http://thesupremeperformanceacademy.com/uploads/1/3/0/6/130620909/kemuneli.pdf
    • https://nefabasovi.weebly.com/uploads/1/3/0/5/130551597/9297284.pdf
    • http://kylestevenanderson.com/uploads/1/3/0/4/130476684/7082681.pdf
    • http://dragoonitcn.net/uploads/1/3/0/4/130483978/togitulut.pdf
    • https://renerinefebegu.weebly.com/uploads/1/3/0/4/130476880/84013c72db779e1.pdf
    • http://journey2wholeness.net/uploads/1/3/0/6/130604885/cc66f26727.pdf
    • http://beyourselfie.net/uploads/1/3/0/6/130639278/c241da2bb6c4ba5.pdf
    • http://claraspilates.net/uploads/1/3/0/5/130540559/luwirof_poxudijabu.pdf
    • http://eclipse-weddingcars.co.uk/uploads/1/3/0/5/130539465/xetopurinirikime.pdf
    • http://tcsonline.net/uploads/1/3/0/6/130604270/130604270.html#critical+path+method+example+questions+and+answers
    • http://beyourselfie.net/uploads/1/3/0/6/130639278

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000176a.bin
ec40eb4277c5c0defa2ebcf0c60c3bc6730f3993b196c64d41cf45e44aea7d54		 pdf-font-stream PDF embedded font (sfnt) at offset 0x176A 7988 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.