Malicious PDF — malware analysis report

Static analysis result for SHA-256 a9be79dcc837db4f…

MALICIOUS

PDF

47.8 KB Authoring application: pdf-parser
MD5: b53f24071036e19c664d0ba269031cb3 SHA-1: 39f6a423d5058ed7d473f328e33e79b05961599b SHA-256: a9be79dcc837db4fb70124979cea777b1d670a231a63cd313af8d8610f9d37e9
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic, directing to other PDF files. This is a common technique for SEO manipulation or to distribute malicious payloads. The ClamAV detection as Pdf.Phishing.TtraffRobotInstall-7605656-0 further supports a malicious classification. The ML classifier also strongly indicated maliciousness.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://bbtreeservice.net/uploads/1/3/0/6/130639100/bevag.pdf
    • http://beckandclem.com/uploads/1/3/0/6/130640090/bixejubaji.pdf
    • https://wefowesunin.weebly.com/uploads/1/3/0/5/130540472/cc570ab2c34b0.pdf
    • http://2ndchancecollectibles.com/uploads/1/3/0/5/130540788/4201279.pdf
    • http://tan.srpautomotrestucuman.com/uploads/2020/01/29/8482.pdf
    • http://drewgrahamart.com/uploads/1/3/0/5/130544898/tefixego.pdf
    • http://stylogentlemensweekend.com/uploads/1/3/0/2/130272925/4047685.pdf
    • http://diestrodecuerdas.com/uploads/1/3/0/5/130546803/bizejetexa_wiwepexera.pdf
    • http://beatricecloakefineart.com/uploads/1/3/0/2/130272483/b1b41b24f43.pdf
    • http://cindycroot.com/uploads/1/3/0/4/130489933/derunuxusoli.pdf
    • http://zajigadad.zoomroom63.ru/uploads/2020/01/27/5863cf6b8be7549.pdf
    • http://liw.street-retail.com/uploads/2020/01/27/eb3bea.pdf
    • http://meridian-dcg.com/uploads/1/3/0/3/130379096/5221796.pdf
    • http://zob.qayl.club/uploads/2020/01/27/52d7f7ed73f5d.pdf
    • http://pofos.otzyvok.com/uploads/2020/01/29/1e5a50bf883.pdf
    • http://ninaalessandri.com/uploads/1/3/0/6/130604562/042f71.pdf
    • http://liluscott.com/uploads/1/3/0/2/130288720/tajajufugobosunuso.pdf
    • http://callylawson.com/uploads/1/3/0/5/130550711/52f2da4fe7.pdf
    • http://osmosistours.com/uploads/1/3/0/5/130541028/b3fc713e6d0e1.pdf
    • http://mynaturalhairspa.com/uploads/1/3/0/4/130436068/130436068.html#t%C3%A9l%C3%A9charger+whatsapp+gb+apk+nouvelle+version

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001753.bin
6a6b27eaaae4ded7dd57415748925a310fded0b7c7daa214f809f05c4dc9c490		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1753 9068 bytes
font_01_sfnt_off00007fc6.bin
83d89f79375f7f339e88070a8779324ce221c94923bff415e388e162fbc46cfe		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7FC6 2604 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.