Malicious PDF — malware analysis report

Static analysis result for SHA-256 9fb6affdddc24fe7…

MALICIOUS

PDF

34.5 KB Authoring application: SWFTools First seen: 2020-09-24
MD5: e5b6440b86c676fb390e8e349dcc3a4c SHA-1: 8e4416578b0ca176ffa4fcebf1b51329c931293e SHA-256: 9fb6affdddc24fe781eed7d37eeff10e2e5c26d690d4fa458625c6ac886b2d3b
192 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF file was flagged by multiple heuristics, including a critical PDF_SEO_LINK_FARM rule and ClamAV detection for Pdf.Phishing.TtraffRobotInstall. The primary attack pattern involves a large number of embedded URLs pointing to external PDF files, suggesting a link farm or distribution mechanism. The ML classifier also strongly indicated maliciousness.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • PDF link to algorithmically-generated URL high PDF_RANDOM_URL_LINK
    PDF contains a clickable HTTP(S) link whose host looks algorithmically generated (pronounceable-random labels) and whose path/query carries a long high-entropy token. This is the randomized-redirector pattern of malspam phishing lures — the visible document is only a prompt — not a PDF parser vulnerability.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://we-have-hope.com/uploads/1/3/0/4/130488312/7145347.pdf In PDF document text
    • http://safecleanasc.com/uploads/1/3/0/6/130640013/fakepaxofol.pdfIn PDF document text
    • http://brihaberdesign.com/uploads/1/3/0/6/130621998/witowifoko_toposudifoxaw_rosozukovarej.pdfIn PDF document text
    • http://patosgatos.com/uploads/1/3/0/7/130776484/xoliwalasod.pdfIn PDF document text
    • http://mywashcard.ca/uploads/1/3/0/2/130271049/972fe6a.pdfIn PDF document text
    • http://webdisk.413classifieds.com/uploads/1/3/0/3/130313468/3dc884422.pdfIn PDF document text
    • http://dopemedicalapparelandaccessories.com/uploads/1/3/0/6/130639998/sipijewosoke.pdfIn PDF document text
    • http://mhballhockey.com/uploads/1/3/0/3/130323163/6772939.pdfIn PDF document text
    • http://lafabriquededessins.com/uploads/1/3/0/5/130551468/0915c.pdfIn PDF document text
    • http://mmeconnect.com/uploads/1/3/0/6/130622080/fijadazojulolejupi.pdfIn PDF document text
    • http://antenoraforum.biz/uploads/1/3/0/7/130776078/difele.pdfIn PDF document text
    • http://autumnmoonphotography.com/uploads/1/3/0/5/130589205/66cee5e62.pdfIn PDF document text
    • http://x0729992xstreamtravel.xsideas.com/uploads/1/3/0/7/130775743/130775743.html#grade+2+ac+joint+separation+x+rayIn PDF document text

Related samples 1

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002e7a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2E7A 8312 bytes
SHA-256: a12822b32fa66f9203bc3add6a78d084047ed4e0e066a909844cd137d082d703

Open this report in the interactive analyzer, or submit your own file for analysis.