Malicious PDF — malware analysis report

Static analysis result for SHA-256 9b8891c3cdb0e48b…

MALICIOUS

PDF

35.3 KB Authoring application: PDF Studio
MD5: bb76dd08c994e289c5407883560903c6 SHA-1: 055f0c0ec989302d7c280e8a30ea5c7b5bd1f4ed SHA-256: 9b8891c3cdb0e48bbad7e8cb5249856e9663a1d40ac8fb86f08a80146ddbd109
150 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The PDF contains a large number of embedded URLs pointing to other PDF files, a technique often used for SEO manipulation or to distribute malware. The ClamAV detection and ML classifier strongly indicate malicious intent. The primary attack pattern involves directing users to a link farm of external PDFs, likely to host phishing content or further malware.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://swenwaterreus.com/uploads/1/3/0/4/130488294/gogop_fofovebeliniz_xedinexa_kodunaf.pdf
    • http://japa.misstourist.net/uploads/2020/01/28/1513348.pdf
    • http://dixiewillowdesigns.com/uploads/1/3/0/4/130483565/zusibuxojovaki.pdf
    • http://moveonidiomes.com/uploads/1/3/0/6/130605302/4548565.pdf
    • http://ayemade.scot/uploads/1/3/0/6/130620395/e4e1badf.pdf
    • http://fome.santorius.ru/uploads/2020/01/29/2464c7e8de.pdf
    • http://krowncustomcues.com/uploads/1/3/0/3/130323972/laxol.pdf
    • http://organicolosangeles.com/uploads/1/3/0/5/130539678/4520387.pdf
    • http://dumu.czechgoods.ru/uploads/2020/01/28/dijebagajivali-febafogarunenel-vagotonunemo-kodogix.pdf
    • http://boxagiv.vipiski-besplatno52.icu/uploads/2020/01/27/fuwik_tulet.pdf
    • https://fimemevele.weebly.com/uploads/1/3/0/4/130490181/gawivuxa.pdf
    • http://datingwithdaniella.com/uploads/1/3/0/4/130491594/592729074.pdf
    • http://sabinescottage.com/uploads/1/3/0/3/130379336/teripus.pdf
    • http://moayas.com/uploads/1/3/0/6/130605448/db866f88297e7fa.pdf
    • http://memoryicons.net/uploads/1/3/0/6/130621785/2907180.pdf
    • http://myentouragemusic.com/uploads/1/3/0/5/130539757/130539757.html#br%C3%BCche+%C3%BCbung+pdf

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000013d0.bin
e98b32962b444c29b1c0f87d17e2122e51863390de1cecd40254ae9f1827cf9f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13D0 8900 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.