Malicious PDF — malware analysis report

Static analysis result for SHA-256 afaf342c487aca61…

MALICIOUS

PDF

42.2 KB Authoring application: pdf-parser
MD5: dc4b90004a4a58ca911dddf818f0aa84 SHA-1: 5d53e09ea6417a78615338f955915814c3c11336 SHA-256: afaf342c487aca61264fdc4a7084c1190f927e561404627e0841ec780ea86504
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded URLs, identified by the PDF_SEO_LINK_FARM heuristic, which strongly suggests a link farm or phishing campaign. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a malicious intent. The ML classifier also flagged this PDF with high confidence. The primary URL identified is http://bearcrack808.com/uploads/1/3/0/6/130620154/kivumoredilopo.pdf.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://bearcrack808.com/uploads/1/3/0/6/130620154/kivumoredilopo.pdf
    • http://sorfhavuz.weebly.com/uploads/1/3/0/6/130639327/4080f14aaea5.pdf
    • http://protectivearmour.com/uploads/1/3/0/6/130603696/wabaropo-lofaviwoji.pdf
    • http://215mainstreet.com/uploads/1/3/0/2/130272930/8151245.pdf
    • http://101taiwantour.com/uploads/1/3/0/4/130476850/roletedopugeb.pdf
    • http://chinasummercamp.org/uploads/1/3/0/2/130289385/5719a132a9fb0.pdf
    • http://oprosniksell.xyz/uploads/2020/01/29/lakofupoke_sejunanak_kipepexagowuf_sigofoniwuwoz.pdf
    • http://wegutoxi.vr-journal.ru/uploads/2020/01/27/6473355.pdf
    • http://vixaba.avtotool.ru/uploads/2020/01/28/kalow.pdf
    • http://geb.sunparkspb.com/uploads/2020/01/27/lawatewuta.pdf
    • http://agapekennelswhitewater.com/uploads/1/3/0/2/130270923/pilegemesitemej_rexetoviwi_muzemed_lixew.pdf
    • http://limobavanu.zapad-auto.com/uploads/2020/01/28/2705980.pdf
    • http://jiradaj.gcointrading.com/uploads/2020/01/28/mibewij-rotix.pdf
    • http://elkonas.store/uploads/2020/01/29/adf4b26.pdf
    • http://kiganu.mypublicwifi.ru/uploads/2020/01/29/forinevibazo.pdf
    • http://abidinghopeinstitute.org/uploads/1/3/0/3/130313247/7242772.pdf
    • http://abbottconstruction360.com/uploads/1/3/0/5/130545327/9420908.pdf
    • http://rucomingout.com/uploads/1/3/0/4/130483650/7280914.pdf
    • http://mirandapueyo.com/uploads/1/3/0/6/130620274/8164353.pdf
    • http://wishingpermission.com/uploads/1/3/0/6/130621390/5963030.pdf
    • http://angiessnowhut.com/uploads/1/3/0/6/130604876/a8bbe29a23aa0.pdf
    • http://wellcampairportxpress.com/uploads/1/3/0/6/130603985/2268100.pdf
    • http://jov.evrodom.icu/uploads/2020/01/28/rupozi_falafazit_lokixamulujumol.pdf
    • http://moanalipopo.com/uploads/1/3/0/6/130639051/fedopovola.pdf
    • http://musicoterapias.com/uploads/1/3/0/6/130604520/130604520.html#bodies+of+water+worksheets+for+kindergarten

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001701.bin
c7386f97db0d2490a421227e86a59b377f403f24ea53a400711c211b5c83121e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1701 8196 bytes
font_01_sfnt_off00005da7.bin
779aa567746046747dac965df7fdfb06ff632674a0a99ce247a327bf89f0fa63		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5DA7 16036 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.