Malicious PDF — malware analysis report

Static analysis result for SHA-256 cca929265a7b180e…

MALICIOUS

PDF

34.8 KB Authoring application: SWFTools
MD5: dd2512b78e451bd92f417413a1e362bc SHA-1: 04345ee432713f78e4482c0f95ac5245015025db SHA-256: cca929265a7b180ef82099593447f238a81809f52a55af0aeb0d6ebb60490510
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Phishing: Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links to other PDF files hosted on various domains, indicative of a link farm or SEO spam campaign. ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the ML classifier's high confidence score further support a malicious classification. The document body, though heavily corrupted, contains fragments of text related to medical conditions, which may be used as a lure.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://theminimalistcreator.com/uploads/1/3/0/6/130604169/gotidugi-dunes-sumewisavoxiki-diwujulunu.pdf
    • http://www.sea-feather.com/uploads/1/3/0/4/130476271/mejowak.pdf
    • http://help4helpless.org/uploads/1/3/0/5/130588640/sonanirideripugiwi.pdf
    • http://scienceroom302.com/uploads/1/3/0/4/130483351/jafanasage-kikofenewozug-bofat-kunomumavexi.pdf
    • http://bswheadworks.com/uploads/1/3/0/2/130289290/00bda41.pdf
    • http://weefestival.com/uploads/1/3/0/4/130489122/virumorolunuwetaxuze.pdf
    • http://zipganizer.net/uploads/1/3/0/5/130588343/nixivesajewi.pdf
    • http://celerigen.com/uploads/1/3/0/7/130739926/3227041.pdf
    • http://maria-cipriano.com/uploads/1/3/0/2/130288465/1511014.pdf
    • http://facialplasticsurgery.tips/uploads/1/3/0/2/130273578/zizipinaxewi.pdf
    • http://onlyamom.com/uploads/1/3/0/6/130639334/pepomafatos_gafutekumenino_jikuxusaboriwup_wapiti.pdf
    • http://coingrandma.com/uploads/1/3/0/7/130738569/6164f777445e.pdf
    • http://reciclajesocial.com/uploads/1/3/0/7/130739764/4e18dde8.pdf
    • http://neilfoxhealthandfitness.com/uploads/1/3/0/7/130775986/4593662.pdf
    • http://thesoonernetwork.com/uploads/1/3/0/6/130640047/130640047.html#causas+de+anemia+microcitica+en+ni%C3%B1os
    • http://ptc.company.com/uploads/1/3/0/7/130775519/bapebizamasifibemi.pdf

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002df6.bin
73608ccb195c392fcea50328298f0157fc62f154960aaf81a29db6f4fa83706a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2DF6 8004 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.