Malicious PDF — malware analysis report

Static analysis result for SHA-256 a09f1a35f1fb2019…

MALICIOUS

PDF

31.1 KB Authoring application: Inkscape
MD5: ae65cd794204be9d6a4e4ea1ebc4218e SHA-1: d3cdf20ad4f7ea976d571aca620e490571a3bd95 SHA-256: a09f1a35f1fb2019a3ab645ddc7688763e036d48ff99f2457f3b9e67bba71e9d
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious File

This PDF file was flagged by multiple heuristics as malicious, including a critical ClamAV detection for 'Pdf.Phishing.TtraffRobotInstall-7605656-0'. The primary attack pattern involves a link farm of external PDF documents, with the first URL being http://jinyu.us/uploads/1/3/0/2/130271219/9553740.pdf. This suggests the document is designed to redirect users to a large number of other potentially malicious or SEO-manipulated PDF files.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://jinyu.us/uploads/1/3/0/2/130271219/9553740.pdf
    • https://memupekidatuga.weebly.com/uploads/1/3/0/5/130588961/3740586.pdf
    • http://ellipseatlantic.com/uploads/1/3/0/5/130540868/pagedetif_witawupaxajipi.pdf
    • http://rachelnamba.com/uploads/1/3/0/7/130739452/tamakaguketir-fiwamo-vujuzipodimu-potuwib.pdf
    • http://zcbcspfld.org/uploads/1/3/0/6/130604379/tinivaragiranogaxeze.pdf
    • http://anteroproducts.com/uploads/1/3/0/3/130379492/vuvaroxasewuduvozon.pdf
    • http://radarx.org/uploads/1/3/0/4/130435570/8360759.pdf
    • http://bengbengtrading.com/uploads/1/3/0/2/130272406/jawoza.pdf
    • http://drberrycoaching.com/uploads/1/3/0/5/130589090/5826c355d.pdf
    • http://jub.seoki.ru/uploads/2020/01/28/vesepakoximoje-beweraxe-tukefuvajoga.pdf
    • http://ne-surgerycenter.net/uploads/1/3/0/5/130546971/130546971.html#aggreko+plc+annual+report

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000123b.bin
ce3265fefe9365589b16e2088a94377c188720adfb3cb433a6d5caf30b3dc41a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x123B 7264 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.