Malicious PDF — malware analysis report

Static analysis result for SHA-256 af6f96ea680a0859…

MALICIOUS

PDF

74.4 KB Authoring application: Scribus
MD5: 1707a194a50b57ffe6bb0eeba479a345 SHA-1: c207aefed87e0639200864a0a4b37f6f0aedf0ec SHA-256: af6f96ea680a0859f1bf527686549c7bf3fa0a276c0bbed56a3f9371f2240bfc
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file was flagged by multiple heuristics, including a critical finding for a link farm and ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0'. The embedded URLs suggest a phishing or traffic redirection scheme. The document body is heavily obfuscated and unreadable, but the presence of numerous external links points to a malicious intent to direct users to potentially harmful content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://tawuzus.vipiski-besplatno9.icu/uploads/2020/01/27/devozalomedewuru.pdf
    • http://thehuffproject.com/uploads/1/3/0/5/130550700/jojaritexiturew_mesomazibijeb_zaxex_mejis.pdf
    • http://primeclassutah.com/uploads/1/3/0/6/130604079/475029.pdf
    • http://stampexinternational.com/uploads/1/3/0/6/130621682/nefafamuwu.pdf
    • http://rivesdynamics.com/uploads/1/3/0/5/130550708/kejikoxagukitamu.pdf
    • http://romowi.meitav-shuvu.org/uploads/2020/01/29/f5165767.pdf
    • http://vopareju.ustroymsk.ru/uploads/2020/01/27/tajulu.pdf
    • http://meyoufitness.com/uploads/1/3/0/6/130604425/kiwetaferid-rigepelitudekin-lawiruxojudobe-fuvulereku.pdf
    • http://princestreetam.com/uploads/1/3/0/5/130551294/duxoxogaxepunas-puwulofibexevi-kugovikugapafek-jujowew.pdf
    • http://kpsmusik.com/uploads/1/3/0/6/130639822/167747d1ede1.pdf
    • http://fabokajenu.tkantares.ru/uploads/2020/01/27/fupuvupeput-tatuzuk-faruxusepus.pdf
    • http://pegijuju.lightmarinas.ru/uploads/2020/01/28/04d65d92e88da3c.pdf
    • http://levekijog.javcpu.com/uploads/2020/01/28/84509.pdf
    • http://studyconnectnz.com/uploads/1/3/0/5/130588842/8988975.pdf
    • http://oliveraconst.com/uploads/1/3/0/6/130605443/mixufofepoxepeg.pdf
    • http://dnatransfiguration.com/uploads/1/3/0/4/130489082/tupasitupasuzodawup.pdf
    • https://lifesejarese.weebly.com/uploads/1/3/0/5/130588246/bapiponogijelitu.pdf
    • http://ministryofmixology.com/uploads/1/3/0/2/130271096/zevuvu_surufutewute_furexevo_korovonozova.pdf
    • http://wafa.site-elit.ru/uploads/2020/01/28/welirevaka-dadizes-zafaloruk-vejodetolenad.pdf
    • http://learnganow.com/uploads/1/3/0/6/130604911/130604911.html#t%E1%BA%A3i+after+effect+cs6+full+crack

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000019a3.bin
6a372a5076a8ac662b2b6ea82b7089e127e8e6adcd0638e4d0a5e5938d4fd61c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x19A3 12384 bytes
font_01_sfnt_off0000c8af.bin
27aad4e7100ae85831cc1a9cf4859e84521ff6b1ee9ac199fa10e6c4d4b25dad		 pdf-font-stream PDF embedded font (sfnt) at offset 0xC8AF 2736 bytes
font_02_sfnt_off0000d3b0.bin
6f034ea8d620b0e5ccfbe9863f56bb4c6ba28f264e4e454f3858def02bbcd0bb		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD3B0 25256 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.