Malicious PDF — malware analysis report

Static analysis result for SHA-256 c37584010eb3a469…

MALICIOUS

PDF

57.1 KB Authoring application: SWFTools
MD5: e8dd2906a71c313c99a8a0b37e2058fb SHA-1: 3ada554adb77346c19466d0427ab78e111b55207 SHA-256: c37584010eb3a46968fa26a54d7b6dcd0d1f5c871b8ffb3e90b124040ee41cd5
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of external links, a technique commonly used in SEO poisoning to drive traffic to malicious sites. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the ML classifier output strongly indicate malicious intent. The primary heuristic 'PDF_SEO_LINK_FARM' identifies the mass linking to external PDFs as the core malicious activity, with the first URL being http://karinaterrazas.com/uploads/1/3/0/2/130272557/zaxilab-rokijelaw-bogobatijuxop-pipaxoriwajuf.pdf.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9989

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://karinaterrazas.com/uploads/1/3/0/2/130272557/zaxilab-rokijelaw-bogobatijuxop-pipaxoriwajuf.pdf
    • http://nuvisionconstruction.com/uploads/1/3/0/5/130590653/sanijedefojo-bewux-dejoze.pdf
    • http://dpjutzi.com/uploads/1/3/0/6/130639291/sadivag.pdf
    • http://harvestleaders.org/uploads/1/3/0/3/130323260/d976b9676f86e92.pdf
    • http://beyondbedside.com/uploads/1/3/0/8/130814337/dinumozibonofi.pdf
    • http://sanctuaryelectrical.com/uploads/1/3/0/4/130492771/lanekazogupe_merejatan_zatibagotiteg.pdf
    • http://esavvie.com/uploads/1/3/0/2/130291579/1542b82b133.pdf
    • http://bigislandpartyrentals.com/uploads/1/3/0/7/130775734/sojowofusex_pekitoziniselu_zuwelilij.pdf
    • http://tammyframptonrealty.ca/uploads/1/3/0/6/130639147/xirujapixu_kobeweki.pdf
    • http://kohltechwindows.com/uploads/1/3/0/7/130740084/gasokuzonupis_dulen_relizibakof.pdf
    • http://stmmlwr.org/uploads/1/3/0/7/130738603/gexuziwizizinuvi.pdf
    • http://washingtonweed.guru/uploads/1/3/0/6/130620861/5700303.pdf
    • http://abc-lyd.com/uploads/1/3/0/4/130476611/vapetiropubiz-xonavef-milad.pdf
    • http://anitaleverarttherapist.com/uploads/1/3/0/5/130551671/pebawejefewez.pdf
    • http://ronyah-arts.com/uploads/1/3/0/2/130291769/jaxowamiwudakil_seburonobo_zofexewago.pdf
    • http://nipmucprincipal.com/uploads/1/3/0/5/130589288/sapubu.pdf
    • http://scrambledtosunnysideup.com/uploads/1/3/0/6/130605368/83ae9396eae.pdf
    • http://www.stteresaofavilacatholiccommunity.org/uploads/1/3/0/4/130483937/fasolanozomuv.pdf
    • http://livelongyoga.com/uploads/1/3/0/5/130589191/6b1e4da87990096.pdf
    • http://bentoone.com/uploads/1/3/0/7/130776034/53790164c66d8.pdf
    • http://colacotwayartstrail.com/uploads/1/3/0/4/130435650/3665030.pdf
    • http://buythebirdseed.com/uploads/1/3/0/7/130740211/5675227.pdf
    • http://shgrp.com/uploads/1/3/0/4/130435875/2daa67f01467bb.pdf
    • http://marijuanabusinessplans.com/uploads/1/3/0/3/130323163/130323163.html#chinese+hanyu+pinyin+dictionary
    • http://imawoikiru.saga-s.co.jp/uploads/1/3/0/5/130589396/474b5d.pdf

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_001_off00003fba.bin
9a20fc2c8a4fd9e07c38f8864c16f8db45eb13d433160899eba85e0efcb48088		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x3FBA 7752 bytes
font_01_sfnt_off000057e1.bin
63f5e27ee3d24cc00d413e59c301cc73ab377383609796993547673f2bea898c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x57E1 2600 bytes
font_02_sfnt_off0000608d.bin
f6ad48e79c07c7ff1d65e8120844a1c4346b00864b8e7c8fc9f5b4b7b7113106		 pdf-font-stream PDF embedded font (sfnt) at offset 0x608D 16212 bytes
font_03_sfnt_off000078fa.bin
fbb5af7443315939fbd4ea8739a13da747bf79e25eccdc874f80ef469dc0ffa8		 pdf-font-stream PDF embedded font (sfnt) at offset 0x78FA 8864 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.