Malicious PDF — malware analysis report

Static analysis result for SHA-256 b2841dd8ecffc516…

MALICIOUS

PDF

43.2 KB Authoring application: QPDF
MD5: 30589ee733c29c2d0c1c1db2960717e8 SHA-1: 44fe5a096cff188c41d5a681d642650420800745 SHA-256: b2841dd8ecffc5166e96791dda0a48bd15dc34cdac813ddc41eb207a66ee0885
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was flagged by multiple heuristics as malicious, including a critical finding for a link farm containing numerous external URLs. The ML classifier also assigned a high probability of maliciousness. The embedded URLs, such as http://gewejas.ecash24.ru/uploads/2020/01/28/071f646f4.pdf, are likely used to redirect users to phishing sites or download further malicious content. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports this assessment.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://koletipovawase.weebly.com/uploads/1/3/0/5/130588940/eee36d1.pdf
    • http://gewejas.ecash24.ru/uploads/2020/01/28/071f646f4.pdf
    • http://gevawi.uykraken.com/uploads/2020/01/28/bagumesifeti.pdf
    • http://bexifagama.remont-msk5.icu/uploads/2020/01/28/7b34265.pdf
    • http://adentamalaysia.com/uploads/1/3/0/2/130292098/legafevidixik.pdf
    • http://egerai.com/uploads/2020/01/29/441add366c84f3.pdf
    • http://femi.rapmo.ru/uploads/2020/01/29/6925432.pdf
    • https://jonibined.weebly.com/uploads/1/3/0/5/130589397/535e3b338fd45.pdf
    • http://nibebota.topdream.pro/uploads/2020/01/27/zosuzif.pdf
    • http://win.itechome.com/uploads/2020/01/29/c47a5f2fc0.pdf
    • http://kznagency.ru/uploads/2020/01/29/xonigujejogujev.pdf
    • http://suzixi.osteosys.org/uploads/2020/01/28/fupivavuwa.pdf
    • http://rujuliva.uristlaboratory.ru/uploads/2020/01/28/doditife_xogatekegozexa_dufurun.pdf
    • http://zowe.fluger.icu/uploads/2020/01/28/3b24bccbb7c49d.pdf
    • http://carpetcleancary.com/uploads/1/3/0/5/130539128/130539128.html#python+data+science+book

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001392.bin
18508c53e958d161e3e61c51148fb6bb0b81765f8549bebe327c130b617ebcf4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1392 8460 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.