Malicious PDF — malware analysis report

Static analysis result for SHA-256 cf517f8385e95a98…

MALICIOUS

PDF

41.5 KB Authoring application: Nitro PDF
MD5: 0cc7a1cf5c962211a5459ac1862ff9d4 SHA-1: acd1e0b12247b791e1eb8d2dc972f5601a71d484 SHA-256: cf517f8385e95a9895c20f8019fd710cd01c3f28e7320b27e33183de0eba537e
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF was flagged by multiple heuristics, including a critical finding for a large external link farm. The document body contains numerous URLs, suggesting a phishing or redirection attempt. The ClamAV detection of 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a phishing or traffic redirection purpose.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://obdsite-top.xyz/uploads/2020/01/29/wogixazoxinekibi.pdf
    • http://bevume.mupoisk.info/uploads/2020/01/28/dee6fcc51fe1.pdf
    • http://monkeesconcerts.com/uploads/1/3/0/5/130551704/6dcc41e.pdf
    • http://northshorepersonalcoaching.sydney/uploads/1/3/0/3/130379204/zetojifin-kilubaxun.pdf
    • https://witoxovi.weebly.com/uploads/1/3/0/3/130379371/nazufureziwuv_vaxekunofomewef_kobuvod_gumawowiwog.pdf
    • http://printtex.biz/uploads/2020/01/27/fepirorasil-suzix.pdf
    • https://komuzobejur.weebly.com/uploads/1/3/0/4/130483546/9e467b.pdf
    • http://tomufive.kupitonline.info/uploads/2020/01/27/rozumasawasinibezada.pdf
    • http://kicksonclocks.com/uploads/1/3/0/5/130550758/7bd7449527176.pdf
    • http://zikatu.bottinnok.xyz/uploads/2020/01/28/kemipib-jijojadugekijan-mozoge.pdf
    • http://vobaf.guarchibao-fatcaps.info/uploads/2020/01/28/985a6289b.pdf
    • http://pourvoiriefrenchconnection.com/uploads/1/3/0/6/130621909/neropewuzugavakudud.pdf
    • http://maggieakins.com/uploads/1/3/0/3/130313471/duxanomabujir-vupoxi-vixat-vuwafupemi.pdf
    • http://pagi.masternode-sc.com/uploads/2020/01/27/5987811.pdf
    • http://wowunof.audiostart10.icu/uploads/2020/01/28/5235260.pdf
    • https://wajunamakizodes.weebly.com/uploads/1/3/0/4/130483138/65c4b760b97ff6b.pdf
    • http://compassion-for-kids.org/uploads/1/3/0/4/130436054/5197662.pdf
    • http://safiasclothing.com/uploads/1/3/0/6/130605442/jogezijajeg.pdf
    • https://zulaxojixo.weebly.com/uploads/1/3/0/5/130588145/5634ba999.pdf
    • http://metalsbullbear.com/uploads/1/3/0/5/130588735/gejiwurubekol_vutemipokapeg_kafemaletoga.pdf
    • http://summervilleprobateattorney.com/uploads/1/3/0/5/130543093/130543093.html#black+cherries+nutritional+information

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001698.bin
261d98d9a0d14f16643e1c59cece40939ee94918c7a278319bcda25157e6230b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1698 8020 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.