Malicious PDF — malware analysis report

Static analysis result for SHA-256 c07b20bb85c66039…

MALICIOUS

PDF

38.1 KB Authoring application: pstoedit
MD5: 2fcd850e3e77da90ec138b1f0300f1bb SHA-1: aa5fb16b0ad3328ebc79caeb4f0d9811768b8f43 SHA-256: c07b20bb85c660398277d6f5d05eed8d4ac88ff0488613a20ddca67892035772
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded external links, identified as a 'PDF_SEO_LINK_FARM' heuristic. This suggests a phishing or redirection attempt, aiming to drive traffic to a network of potentially malicious sites. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a phishing or traffic-driving motive. No scripts were extracted from this sample, limiting the ability to determine specific execution behaviors.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://theyoungmum.com/uploads/1/3/0/5/130543059/13e323.pdf
    • http://greensboromusicteachers.org/uploads/1/3/0/6/130621852/wuxikolemanem.pdf
    • http://quintechservices.com/uploads/1/3/0/4/130435987/dopilalep.pdf
    • http://metroprointeriors.com/uploads/1/3/0/3/130312968/fosozebudobifogepari.pdf
    • http://creepyoutfitlab.com/uploads/1/3/0/6/130603709/pidurak_wison.pdf
    • http://ciencia-sociedad.org/uploads/1/3/0/6/130639814/6478160.pdf
    • http://makeartsforabetterlife.org/uploads/1/3/0/5/130541552/7552637.pdf
    • http://myskinfit.com/uploads/1/3/0/6/130621751/8371426.pdf
    • http://neverbetterfishingcharters.com/uploads/1/3/0/5/130590154/gevisirawiwu_puxoforurejate_somedadaviwag_jaruvubotudul.pdf
    • http://www.zhonglab.org/uploads/1/3/0/9/130969390/28fe8190f892.pdf
    • http://www.illuminatedwindows.net/uploads/1/3/0/7/130738673/f7e831e.pdf
    • http://reisteel.net/uploads/1/3/0/4/130490181/aa054ae1e.pdf
    • http://christchurchportland.org/uploads/1/3/0/5/130589309/komusenoli.pdf
    • http://jakeandgui.com/uploads/1/3/0/5/130539992/farumixekebalu_boninu.pdf
    • http://www.wildrescuetv.com/uploads/1/3/0/6/130620478/7013877.pdf
    • http://wellnow212.com/uploads/1/3/0/6/130621583/zegopijedis.pdf
    • http://jthomrich.com/uploads/1/3/0/8/130874469/130874469.html#anllela+sagra+workout+download
    • http://christchurchportland.org/uploads/1/3/0/5/130589309/komuseno

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002d86.bin
d907c570f1f8f2d62f38d7529dbf77de46ca3a1917ec53aca7a78bae59874b04		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2D86 2616 bytes
font_01_sfnt_off00003936.bin
0c7e786e01493df94602ce528fd18fe9adadb1f2a3abfb868e492e4c51eaf8b9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3936 7864 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.