Malicious PDF — malware analysis report

Static analysis result for SHA-256 b84747df36637738…

MALICIOUS

PDF

39.1 KB Authoring application: SWFTools
MD5: f891436d2ee46958fa0af2e18c33e14b SHA-1: 4a117dcdddfa2302da203b5c92d132af3bc8d2ba SHA-256: b84747df3663773880647f86b1d3cbc4603aa7f94b5f6c522d49868d87fca410
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded URLs, constituting a link farm. This is strongly indicative of a phishing or traffic-driving campaign, as suggested by the 'PDF_SEO_LINK_FARM' and 'ML_NYX_PDF_MALICIOUS' heuristics. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports this classification. The embedded URLs are designed to redirect users to potentially malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://chloeskidmore.com/uploads/1/3/0/6/130604518/jejibabepevekav_pewegotopevob_wazukobino_parixe.pdf
    • http://cpanel.albufeirainn.com/uploads/1/3/0/5/130588403/jedasadibore.pdf
    • http://wichitajoyorganics.com/uploads/1/3/0/3/130379087/marojudadozima.pdf
    • http://nchep2017.org/uploads/1/3/0/7/130775308/9e89d18284223.pdf
    • http://holochainers.com/uploads/1/3/0/4/130483542/bogufakow-jotaki.pdf
    • http://cultofone.us/uploads/1/3/0/6/130604083/kafakig-lexetite.pdf
    • http://balloonsoverbranson.com/uploads/1/3/0/4/130436068/sexawubogefete_gawefimadebaxu_zixusoxuda_jutewunud.pdf
    • http://maccheese.net/uploads/1/3/0/6/130639462/gedazuj_fadomixirobakas.pdf
    • http://rochesterreadingtutor.com/uploads/1/3/0/6/130639233/4862190.pdf
    • http://bannerfm.com/uploads/1/3/0/6/130621871/298ba8b2a6fe1ce.pdf
    • http://mosaicwellington.org/uploads/1/3/0/6/130639155/18039d3ea7774cc.pdf
    • http://berksdogtraining.org/uploads/1/3/0/3/130323635/tijuraxagezofax.pdf
    • http://ketoboxie.com/uploads/1/3/0/8/130814430/sifolewagupilu_walazudan.pdf
    • http://memphiscounsel.net/uploads/1/3/0/6/130639397/9629486.pdf
    • http://somethingblueresale.com/uploads/1/3/0/4/130435857/jazijevamelobesa.pdf
    • http://iclubgood.net/uploads/1/3/0/5/130590432/kedegiki-nisijazufi-kexege.pdf
    • http://mrsmoorehubbardsclassroom.com/uploads/1/3/0/6/130620375/4209053.pdf
    • http://ignomics.net/uploads/1/3/0/6/130621490/51c892832383.pdf
    • http://www.406cavoodle.com/uploads/1/3/0/5/130588894/lopewezore_woderuze.pdf
    • http://mfcocksart.com/uploads/1/3/0/4/130483136/kosibi-nogena.pdf
    • http://lilmissrealtor.com/uploads/1/3/0/7/130739826/molefexu.pdf
    • http://shopity.space/uploads/1/3/0/2/130289485/gafedeziba_fosek.pdf
    • http://cat.satcomarca.com/uploads/1/3/0/7/130776791/wotomano.pdf
    • http://myangeliques.com/uploads/1/3/0/6/130622061/5099048.pdf
    • http://alohastudionh.com/uploads/1/3/0/5/130543653/rafawem_likot_xivurawerezad_liwafosufu.pdf
    • http://tuitionhotsauce.com/uploads/1/3/0/7/130739505/130739505.html#aicardi+goutieres+syndrome+icd+10
    • http://mrsmoorehubbardsclassroom.com/uploads/1/3/0/6/130620375/4209

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000352c.bin
fdf451c038821fd8c83b762831d2b0ab2995d9caf592804272d680745cfc20b0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x352C 7664 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.