Malicious PDF — malware analysis report

Static analysis result for SHA-256 d1fc6bebf228b3b8…

MALICIOUS

PDF

36.7 KB Authoring application: Inkscape
MD5: e0d0530bafa868e033e1efab6fabf552 SHA-1: ff1b2bf3c789458c0dcb9327fd6757685af7260e SHA-256: d1fc6bebf228b3b8cc264c634d24fb0da64054ca980470f907be451cbaec2447
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1566.002 Spearphishing Link

The PDF file contains a large number of embedded links to external PDF documents hosted across various domains. This behavior is indicative of a link farm or a distribution mechanism for further malicious content, as flagged by the PDF_SEO_LINK_FARM heuristic. The ML classifier and ClamAV detection strongly support the malicious nature of this file. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://konidarisart.com/uploads/1/3/0/2/130273735/c1f49ca.pdf
    • http://seanhaseymassage.com/uploads/1/3/0/5/130590133/4946799.pdf
    • http://five-words.org/uploads/1/3/0/5/130588747/gafeme.pdf
    • http://tattyscoins.co.uk/uploads/1/3/0/5/130551049/e128a.pdf
    • https://lamigowa.weebly.com/uploads/1/3/0/5/130543870/zubazixejituxuwaz.pdf
    • http://nibir.mupoisk.info/uploads/2020/01/28/8c7caf1b1c97cd.pdf
    • http://choosesani.com/uploads/1/3/0/5/130551524/dexivapubi-merilotomop.pdf
    • http://vabevu.smartmeteo.ru/uploads/2020/01/27/wuribafupimob.pdf
    • http://ncpchoirs.com/uploads/1/3/0/5/130543106/genuvi_fosowa_timit.pdf
    • http://americanepilepsyinstitute.com/uploads/1/3/0/4/130476691/eb55c622c78a3ed.pdf
    • http://giperstimulyatsiya-pri-eco.ru/uploads/2020/01/28/bovexekez.pdf
    • http://zekene.molleo.in/uploads/2020/01/29/5729741.pdf
    • http://wamol.osteosys.org/uploads/2020/01/28/naxugifa-maxoz-robotalupupuk.pdf
    • http://floridasnowicecream.com/uploads/1/3/0/6/130604185/4902665.pdf
    • http://succeedwithbrian.com/uploads/1/3/0/5/130551064/5435107.pdf
    • http://wazyshairsalon.com/uploads/1/3/0/5/130590507/7ee9e77.pdf
    • http://parsonsarea.org/uploads/1/3/0/6/130604366/74110af.pdf
    • http://genefanori.infobizplatform.ru/uploads/2020/01/27/gibasadef_tigukubu.pdf
    • http://zotus.rurostelekom.ru/uploads/2020/01/28/216b267bac805b.pdf
    • http://annieluchsinger.com/uploads/1/3/0/3/130323526/374424.pdf
    • http://mychinesewatch.com/uploads/1/3/0/6/130620919/130620919.html#forgiveness+worksheets+pdf

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001576.bin
4cb49c2c74d787f7b2829d6fd89ec07c364a9fad205c5137a805cc4dad27045d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1576 7800 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.