Malicious PDF — malware analysis report

Static analysis result for SHA-256 9beee79b1dd56bd0…

MALICIOUS

PDF

66.4 KB Authoring application: SWFTools
MD5: 9ccf647522025db9e1cc246af24d02c7 SHA-1: 3b7716b109608768bd106e528ede926f710328cf SHA-256: 9beee79b1dd56bd049341e32fde0259d49cc59e6c65a5c15575938617673627c
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the ML classifier output strongly indicate malicious intent. The primary goal appears to be directing users to a network of linked PDF files, likely for SEO spam or phishing campaigns.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://wakurejedajaw.weebly.com/uploads/1/3/0/5/130546294/3922626.pdf
    • https://vinupolumazex.weebly.com/uploads/1/3/0/5/130539517/purowedawedi.pdf
    • http://wodiwu.rostelekomu.info/uploads/2020/01/27/dadurib.pdf
    • https://dipevodukekosu.weebly.com/uploads/1/3/0/3/130312993/864504.pdf
    • http://febezo.paypal-support.bz/uploads/2020/01/27/da8aaf230e01.pdf
    • http://tegamomuj.tauras-metal.ru/uploads/2020/01/28/mevutaf.pdf
    • http://dias-dent.ru/uploads/2020/01/27/11c4e84.pdf
    • https://fubazedixibefo.weebly.com/uploads/1/3/0/4/130436007/pexexawebozewomazat.pdf
    • http://wajase.mactak.center/uploads/2020/01/27/1584397.pdf
    • http://mrbrushgrade5.ca/uploads/1/3/0/5/130588437/nibijiminige-rulupekirugukud.pdf
    • http://innerleithen.online/uploads/1/3/0/6/130620846/9821089.pdf
    • http://gypsyangler.com/uploads/1/3/0/4/130435986/wekejuvokis.pdf
    • http://makewakem.mailsens01.online/uploads/2020/01/29/1e78a.pdf
    • http://xiruzur.nhatminhphoto.online/uploads/2020/01/29/kanezijixaxolenonu.pdf
    • http://harborshorespaddlesports.com/uploads/1/3/0/6/130621413/39282439.pdf
    • http://tempestshadow.com/uploads/1/3/0/6/130604635/nidom_vizemojutadeb.pdf
    • http://whatthefunkdenver.com/uploads/1/3/0/2/130271004/7916993.pdf
    • http://duvun.espace-clientsv3-0range.com/uploads/2020/01/28/fusodi_mikuvugube.pdf
    • http://sweetestdreams.org/uploads/1/3/0/3/130313524/130313524.html#angular+5+viewchild+form

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000104c.bin
bddc7b617d3813b95a053b77f652b84ff7540d81b296904343c41678b197adfc		 pdf-font-stream PDF embedded font (sfnt) at offset 0x104C 9412 bytes
font_01_sfnt_off00009614.bin
e731b6f0bba35dab5eba511e4d345203e097703b2ab5ec727eb802b54424b555		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9614 15276 bytes
font_02_sfnt_off0000c552.bin
d5b1411de63f367ddf2cd17526c4904278590447e0426b10e0f8a81f32d50163		 pdf-font-stream PDF embedded font (sfnt) at offset 0xC552 3276 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.