Malicious PDF — malware analysis report

Static analysis result for SHA-256 aaf17cc70aec79f3…

MALICIOUS

PDF

49.7 KB Authoring application: Adobe PDF Library 9.0
MD5: e844794a5ea6312805519c5eb4ed822c SHA-1: 77b3f0a91dec96826fda924a8ac47a09cb05d27a SHA-256: aaf17cc70aec79f36b920a4ae243a4ed069fd2c029542804925d3cab5d09ffeb
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded URLs pointing to other PDF files hosted on various domains. This behavior is indicative of a link farm or a distribution mechanism for further malicious content, as suggested by the 'PDF_SEO_LINK_FARM' heuristic. The ML classifier and ClamAV detection further support its malicious nature. The primary intent appears to be directing users to a multitude of external resources, likely for SEO poisoning or to serve as a landing page for other threats.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://needavac.com/uploads/1/3/0/5/130590295/1259723.pdf
    • http://tanjazumanschauen.com/uploads/1/3/0/3/130313191/pajalilam_zevota_wasediseli.pdf
    • http://mhcustomhomes.com/uploads/1/3/0/6/130604642/nisezogivamamagug.pdf
    • https://wikixajuv.weebly.com/uploads/1/3/0/5/130539881/sudiwejujena_gujadiva_dutoxi.pdf
    • http://blackwinghunting.com/uploads/1/3/0/4/130483650/filitiri_xagigiga.pdf
    • http://shanahanagency.com/uploads/1/3/0/5/130542717/0b6ec96.pdf
    • http://prabhbroker.com/uploads/1/3/0/3/130313194/bd2f1093280c.pdf
    • http://mytorchdata.com/uploads/1/3/0/3/130323588/45f6b1.pdf
    • http://sirjnaarts.com/uploads/1/3/0/5/130551782/03da449.pdf
    • http://zitop.sovetnmo.com/uploads/2020/01/29/vudesuw_mekajuwofos_vozatiw_jumomomolu.pdf
    • http://chazstyles.com/uploads/1/3/0/4/130435547/f17e0084.pdf
    • http://nocturnewoodworks.com/uploads/1/3/0/3/130323573/tagizojitifut_belaropadekutuz_zesawixekam_zofezoniwer.pdf
    • http://executivecareercoachinstitute.com/uploads/1/3/0/4/130488338/zejiwepewa.pdf
    • http://namiwashcounty.org/uploads/1/3/0/6/130620173/duxonu-serube-jajovunur-vekeruzudur.pdf
    • http://juliejesternewman.com/uploads/1/3/0/3/130323341/130323341.html#amity+park+game+app

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000014b6.bin
118d7d33f794f4c9afb2fd0164c4e1855dea31be80707f9df76f7a6f4d1426b1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x14B6 9584 bytes
font_01_sfnt_off00006a48.bin
779aa567746046747dac965df7fdfb06ff632674a0a99ce247a327bf89f0fa63		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6A48 16036 bytes
font_02_sfnt_off00007e5f.bin
b0a6a33381002d1c379ca931d660fe98df7a73518421c8b234b9dc16af60e95a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7E5F 2696 bytes
font_03_sfnt_off0000872e.bin
b133d2ba8c54b7310bd2a5d38206394d05d7e181f35e2a030cfae1cd9fd81be6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x872E 1808 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.