Malicious PDF — malware analysis report

Static analysis result for SHA-256 ca277cb6f9f454e8…

MALICIOUS

PDF

38.8 KB Authoring application: SWFTools
MD5: d1686b0a7369bc8213bdefcc2b77b118 SHA-1: 7a55c040fd5bac683d7c0605c48e2575d5093569 SHA-256: ca277cb6f9f454e8a6183cc4fb8d44dcf4d5db34d4d01690144710f09c82c059
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF contains a large number of embedded URLs pointing to other PDF files, a technique often used for SEO spam or to host malicious content. ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the ML classifier output strongly indicate malicious intent. The primary attack pattern involves redirecting users to a network of external PDF documents.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://thephysiofitnesssolution.com/uploads/1/3/0/6/130605440/magenazuwabaj-lovivam-zozuludedu-mopunonud.pdf
    • https://mizarixiki.weebly.com/uploads/1/3/0/2/130287456/vagimukedu.pdf
    • http://retobaz.izdekreta.com/uploads/2020/01/27/gadux-tejibokexe.pdf
    • http://thomasvasasphotography.shop/uploads/1/3/0/6/130620325/7141700.pdf
    • http://skinbeautybymaggie.com/uploads/1/3/0/2/130272385/2f8d0.pdf
    • http://ujingroup.com/uploads/1/3/0/4/130483320/1050601.pdf
    • http://vibe.sexsdetmi.com/uploads/2020/01/28/bobexujofan_tefon_rupulofufekete_nofaturajerigeg.pdf
    • http://xufavupara.infusion-web.com/uploads/2020/01/28/1686506.pdf
    • http://kmcreativespaces.com/uploads/1/3/0/2/130289335/908c94e7f55ba.pdf
    • http://zailani.net/uploads/1/3/0/6/130604428/perebaz_jevawobu.pdf
    • http://arthuraviation.com/uploads/1/3/0/5/130589125/3981970.pdf
    • http://travisculinaryarts.weebly.com/uploads/1/3/0/6/130620537/joledetafum-labewarawojo-rumikerijam.pdf
    • http://seacareconsult.com/uploads/1/3/0/3/130323277/5573790.pdf
    • http://northernlightshockeynj.com/uploads/1/3/0/6/130620290/f1ef61379.pdf
    • http://splashsteamboat.org/uploads/1/3/0/3/130324390/9676210.pdf
    • http://randisdollhouse.com/uploads/1/3/0/4/130483492/8767080.pdf
    • http://lexefu.nithyamarriages.com/uploads/2020/01/27/xolabisej.pdf
    • http://merakifarmacy.com/uploads/1/3/0/6/130621109/6919994.pdf
    • http://mymissblue.com/uploads/1/3/0/6/130603913/130603913.html#mamma+mia+piano+notes+mint+music

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000016f4.bin
720340b568e1a7a9c95053b6f2f6b656c940cad1739697507f81f5e50de48224		 pdf-font-stream PDF embedded font (sfnt) at offset 0x16F4 7880 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.