Malicious PDF — malware analysis report

Static analysis result for SHA-256 b8b7007d2ab59302…

MALICIOUS

PDF

41.7 KB Authoring application: SWFTools
MD5: 037abe4cbf2271d3aab23f53593b34e7 SHA-1: f464c1a3823d970d6798d9a35534d6d2563c5d51 SHA-256: b8b7007d2ab59302a9f7ca772e09b7163b63a4e82ea63c67d03264528d3137bc
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded external links, as indicated by the PDF_SEO_LINK_FARM heuristic. The ClamAV detection and ML classifier also strongly suggest malicious intent. The primary function appears to be redirecting users to a network of websites, likely for phishing or distributing further malware. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cockblockproductions.com/uploads/1/3/0/6/130604340/nanujig.pdf
    • http://rannistan.com/uploads/1/3/0/5/130542920/e02f43df217b.pdf
    • http://sheri-johnson.com/uploads/1/3/0/4/130483759/6f84d7bf3ad5.pdf
    • http://aliomarermes.mobi/uploads/1/3/0/5/130546294/bd02f.pdf
    • http://www.tnttoday.org/uploads/1/3/0/9/130969939/85e98.pdf
    • http://www.dallasclinicalpsychology.com/uploads/1/3/0/5/130588780/kexemesamunadiwojo.pdf
    • http://ourbaptistheritage.org/uploads/1/3/0/7/130739938/fexovetojoji-tomotasarale.pdf
    • http://www.letscreatewithrae.com/uploads/1/3/0/8/130813973/tipokilasekipinodaz.pdf
    • http://franklincountystrong.com/uploads/1/3/0/7/130740490/gekefo.pdf
    • http://nickysawesomewebsite.com/uploads/1/3/0/5/130589217/zunomufi.pdf
    • http://mayaaruch.com/uploads/1/3/0/6/130604940/dcdf15cc.pdf
    • http://14centsaminute.com/uploads/1/3/0/5/130590756/vovijalomov-fikajexexig-zogosami.pdf
    • http://lawnservicewintergarden.net/uploads/1/3/0/7/130775085/jonakas.pdf
    • http://alzeen.com/uploads/1/3/0/6/130604056/zukigux.pdf
    • http://amyeschlimanteachingportfolio.com/uploads/1/3/0/6/130603767/dibenobexusogofex.pdf
    • http://chelseahighturkeytrot.com/uploads/1/3/0/5/130544009/b6d33a95ef5.pdf
    • http://mx.iscremodeling.com/uploads/1/3/0/3/130379183/liwisuwovulidi_danorewalo_govozazuviwi_tefoxozageg.pdf
    • http://akronglobal.net/uploads/1/3/0/5/130589145/15549b691.pdf
    • http://pathwaywebdesign.com/uploads/1/3/0/4/130489157/2832853.pdf
    • http://nourishedwombyn.com/uploads/1/3/0/7/130739887/8c10418454fbb51.pdf
    • http://purestreamtechnology.net/uploads/1/3/0/6/130620233/puxul_sanelukegozi_gawedapevebud_jozomakisar.pdf
    • http://www.ololparish.org/uploads/1/3/0/7/130775979/jawetoturamev-majaluboxit.pdf
    • http://pgdsolutions.net/uploads/1/3/0/4/130477234/tuzawanobozaniv-sularodomu-bajajenilen-rexosixev.pdf
    • http://cementfab.com/uploads/1/3/0/6/130621569/130621569.html#acc%2Faha+heart+failure+performance+measures

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003efd.bin
2e3bf81152af3d7ab915a15427a7dc8ac27c3628b817cf81abc955ab232d5fef		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3EFD 8464 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.