Malicious PDF — malware analysis report

Static analysis result for SHA-256 a4bc721b8171fbb4…

MALICIOUS

PDF

45.7 KB Authoring application: SWFTools
MD5: d836a28e55f11a1dcb4db94f7499f598 SHA-1: 88a70a28fbc33ab167b9bddefadbd6158f982158 SHA-256: a4bc721b8171fbb4518f575655189d57e2de656529a5ec1258a876e6b49b9c8a
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was flagged by multiple heuristics, including a critical finding for a link farm containing 31 external PDF links. The ML classifier also assigned a high probability of maliciousness. The embedded URLs suggest a phishing or malware distribution campaign, likely aiming to redirect users to compromised or malicious sites.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://resurrectionoutdoors.com/uploads/1/3/0/5/130540280/jexuvejubetes.pdf
    • http://nycraftworks.com/uploads/1/3/0/5/130588799/dijasaxulalazu.pdf
    • http://hampton-market.com/uploads/1/3/0/2/130287521/b379e616.pdf
    • http://roder.gamerspot.info/uploads/2020/01/28/88813b5c36.pdf
    • http://vefugiv.qpeqwqj.info/uploads/2020/01/28/gilazuxipo-divixuruk.pdf
    • http://diwe.hopifai.info/uploads/2020/01/28/dibuwujefoxo.pdf
    • http://pulezu.avtosvet24.ru/uploads/2020/01/28/1aa0a72d.pdf
    • http://tgi420.ca/uploads/1/3/0/2/130289455/7a5806.pdf
    • http://fcshield.com/uploads/2020/01/29/widuvigozididev.pdf
    • http://wefesi.steuerschroeder.com/uploads/2020/01/29/2321444.pdf
    • http://krigolson.com/uploads/1/3/0/5/130544539/febazem.pdf
    • http://accuplus-parkour.com/uploads/1/3/0/3/130323693/piwiwivewurozinak.pdf
    • http://shopcenter14.fun/uploads/2020/01/28/fononulujalisula.pdf
    • http://bklynfete.com/uploads/1/3/0/6/130620530/jexodiwuluzuwaweti.pdf
    • http://beaconbeerco.com/uploads/1/3/0/5/130588554/6741291.pdf
    • http://aedutah.com/uploads/1/3/0/6/130621589/bopufoboferado.pdf
    • http://kas.remont-msk9.icu/uploads/2020/01/29/03e5a0e6b837da.pdf
    • http://nationalriskmanagementgroup.com/uploads/1/3/0/4/130483871/130483871.html#hallelujah+sheet+music+for+guitar

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000014ad.bin
b75903e12d3988291cb0420879f9d78c21ee13d7a8cfaa54d5a59fcfeb795a57		 pdf-font-stream PDF embedded font (sfnt) at offset 0x14AD 8836 bytes
font_01_sfnt_off00006b2e.bin
669a22844ddb84b64a1d93eb6147c2b8b7ca76f4316fe4be2bbf69c96252e72a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6B2E 16180 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.