Malicious PDF — malware analysis report

Static analysis result for SHA-256 d16884c319127871…

MALICIOUS

PDF

31.7 KB Authoring application: pstoedit
MD5: d410fc4f58b33e6d220caa0cb6fe7c6c SHA-1: 53a7a882c34c336916f55cdca4412e09ddfaf825 SHA-256: d16884c31912787144959802fbf51eb632f3c50a70f2fb1dd5ec9b2445290d54
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic, pointing to other PDF files. The ML classifier and ClamAV detection strongly indicate malicious intent, specifically identified as phishing. The embedded URLs are likely part of a campaign to redirect users to malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://tannothem.pro/uploads/2020/01/28/kadox.pdf
    • http://junivi.kamera360.ru/uploads/2020/01/28/ripifafotegito.pdf
    • http://bristolberlinvintage.com/uploads/1/3/0/6/130639495/durupikid-pebate-nakutuloji-vunesugilovefut.pdf
    • http://bbnla.com/uploads/1/3/0/6/130622110/130622110.html#istanbul+tatili+1968+izle

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000011c3.bin
2a4398a101b307323357b2a1dca763d7759638e2d76f673299ca9cdb1091cd45		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11C3 9788 bytes
font_01_sfnt_off000040da.bin
80f37f72e7976997623e0d33836bc0b606f5b8dde87985f6f96338fee1486c86		 pdf-font-stream PDF embedded font (sfnt) at offset 0x40DA 1804 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.