Malicious PDF — malware analysis report

Static analysis result for SHA-256 97c67c2ac8668c0b…

MALICIOUS

PDF

41.3 KB Authoring application: pstoedit
MD5: 35ddda0aaed8c94cf2be265c8573a74f SHA-1: 02022ee3a883b1f89ccff9e0e03c4ef62aa93476 SHA-256: 97c67c2ac8668c0be9c0f94bfc98e044c6e17ab43958042c0436aae0f5aefb53
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1566.002 Spearphishing Link

The PDF contains a large number of embedded links to external PDF files, a technique often used for SEO manipulation or to host phishing content. The ClamAV detection and ML classifier strongly indicate malicious intent. The primary heuristic identified a 'PDF_SEO_LINK_FARM' with a dominant host of 'papi.jussom.xyz', suggesting this is a central point for the malicious activity.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://papi.jussom.xyz/uploads/2020/01/27/worozuj_tedis_jebozikesuvarom.pdf
    • http://wunepuvu.testim.tech/uploads/2020/01/28/zalufu-gopuzupem-woniger.pdf
    • https://sekinenurasovem.weebly.com/uploads/1/3/0/5/130589014/zuwuz.pdf
    • http://xurubaf.prosamoe.ru/uploads/2020/01/28/3557511.pdf
    • https://bomarumanepa.weebly.com/uploads/1/3/0/6/130604420/fumakazirarefa-fikowiwop-lufalo.pdf
    • http://antonioflowers919.com/uploads/1/3/0/2/130271171/8563815.pdf
    • http://opr0.icu/uploads/2020/01/27/fc7c925a96724.pdf
    • http://vibehighbowspring.com/uploads/1/3/0/4/130490115/9a5809b6654f0d5.pdf
    • http://loxa.metall-msc.ru/uploads/2020/01/27/628de.pdf
    • https://bilewimifi.weebly.com/uploads/1/3/0/5/130551857/susegiwidijafumugan.pdf
    • http://agm93.icu/uploads/2020/01/28/3278079.pdf
    • http://philanimalrescue.org/uploads/1/3/0/4/130483783/977669b7aa55.pdf
    • http://thesingbabysingshow.com/uploads/1/3/0/2/130289800/130289800.html#iobit+advanced+systemcare+ultimate+free

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000012c3.bin
5fa8dc97eb89899d6b6682aed4d9f04c61aeddf1d5445f5a0be6c66871c86b3c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12C3 8092 bytes
font_01_sfnt_off00005f74.bin
f65ec60e74f24b01b33345ef52b34fa98243459834f9a56342c242e239853028		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5F74 4976 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.