Malicious PDF — malware analysis report

Static analysis result for SHA-256 9bf2a9aba32c1cae…

MALICIOUS

PDF

55.7 KB Authoring application: Adobe PDF Library 9.0
MD5: d90328e36e3ce55fce64ac8f1c026fa3 SHA-1: 457f0b7f1ac8433c2c06d8f38235bea3ef375a45 SHA-256: 9bf2a9aba32c1cae80802ba4b01cedba6a9f151439d07e60820dd4f2d56f2122
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic, suggesting a link farm or redirection strategy. The ClamAV detection as Pdf.Phishing.TtraffRobotInstall-7605656-0 and the ML classifier output further support its malicious nature. The embedded URLs are likely used to distribute further malicious content or to engage in phishing activities.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://alaskafoodie.info/uploads/1/3/0/2/130271048/pesefezofam.pdf
    • http://thedragonridersofarvain.com/uploads/1/3/0/6/130622000/tubepo.pdf
    • http://miamfoundation.org/uploads/1/3/0/4/130478663/jutetobasedozaladozi.pdf
    • http://pushkino-narkologiya.ru/uploads/2020/01/27/xikevibakixi.pdf
    • http://dosamu.anketka-cash.top/uploads/2020/01/28/9784153.pdf
    • http://soapytoad.com/uploads/1/3/0/5/130589159/telatotutogap_miwabewod.pdf
    • http://0406shopps02.fun/uploads/2020/01/28/newudakivatokad_fotojif.pdf
    • http://mosquitomaster.net/uploads/1/3/0/5/130551463/zefol.pdf
    • http://gezu.dermashop.tech/uploads/2020/01/27/44328.pdf
    • http://1169training.com/uploads/1/3/0/2/130271139/9187985.pdf
    • http://adtest.site/uploads/1/3/0/4/130435937/vileliviwumodu.pdf
    • http://baf-fencing.weebly.com/uploads/1/3/0/5/130550881/ketejilod.pdf
    • http://beyogaonline.com/uploads/1/3/0/2/130291635/lakisij_vifim_butovonisi_konux.pdf
    • http://zil.litecoin-red.com/uploads/2020/01/29/nemepifofodalumekav.pdf
    • http://abbaproperty.com/uploads/1/3/0/2/130271030/4fee7836089.pdf
    • http://sigoaprendiendo.com/uploads/1/3/0/5/130588378/2ed97630.pdf
    • http://farmdalehawks.org/uploads/1/3/0/2/130272363/xoloju_vigivef.pdf
    • http://chuysmex.com/uploads/1/3/0/6/130604779/1618274.pdf
    • http://scupstateparalegals.org/uploads/1/3/0/5/130539393/2fc298.pdf
    • http://danielamansfield.com/uploads/1/3/0/4/130476632/jupazibowemusiv.pdf
    • http://kapli-molot-tora.info/uploads/2020/01/27/pugefi_bedirobowe.pdf
    • http://makahisland.com/uploads/1/3/0/2/130270912/poruk-xipuloxanipe.pdf
    • http://bib.handorinservice.ru/uploads/2020/01/28/8250119.pdf
    • http://fof.darcis-ko.fun/uploads/2020/01/28/xuvenu.pdf
    • http://gon.amati-mobili.ru/uploads/2020/01/29/2188209.pdf
    • http://bartolomeilaw.com/uploads/1/3/0/6/130604098/130604098.html#migrate+access+database+to+sql+server+2012
    • http://kapli-molot-tora.info/uploads/2020/01/27/pugefi_bedirobowe

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000016c5.bin
c87fd09e9baa23f5083c744ca4f7d94695a2226f0d1fb3566d5cab70a599e02c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x16C5 8032 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.