Malicious PDF — malware analysis report

Static analysis result for SHA-256 d69695690f041e37…

MALICIOUS

PDF

44.9 KB Authoring application: Inkscape
MD5: 0e2cb2a83a2573c13c3c520e576faf84 SHA-1: 68bc01a6fdb5d11ce5dc7adc5e87e3af453a3ea5 SHA-256: d69695690f041e37e0d6a9637c260f545592750db221a5b1e508b2f62c8553ac
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded URLs pointing to external PDF documents, a technique often used for SEO spam or to redirect users to malicious sites. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the ML classifier strongly indicate malicious intent. The document body contains fragmented text related to 'Inkscape Intensifying adverbs advanced' and a URL, further supporting the lure-based attack pattern.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://safedreams.org/uploads/1/3/0/5/130588633/zutetofel-fagavo-vajeze-lufawadexo.pdf
    • http://monteschoenstatt.org/uploads/1/3/0/6/130639776/9634731.pdf
    • http://melewata.paypal-myaccount.net/uploads/2020/01/29/5992386.pdf
    • http://oaklands-care-home.com/uploads/1/3/0/7/130739243/zavegakuge-sirivuzu-vepewa-noxesudu.pdf
    • http://tanishqspa.com/uploads/1/3/0/5/130551604/gunedisivodadema.pdf
    • http://sherwoodrooster.com/uploads/1/3/0/7/130776413/fezakisezezubed.pdf
    • http://xibadodur.vizitki-listovki.ru/uploads/2020/01/28/900fc.pdf
    • http://catchnrelease.org/uploads/1/3/0/3/130323424/c671da18135.pdf
    • http://tijuanadragones.com/uploads/1/3/0/3/130312996/6bac175.pdf
    • http://beanbagswim.com/uploads/1/3/0/6/130620604/15212.pdf
    • http://afaparents.org/uploads/1/3/0/4/130488888/130488888.html#intensifying+adverbs+advanced

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001273.bin
6c205a7cf1c8c74f532bec74a418964f30fb00932ff8eac63d4b7edd47a2b909		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1273 8416 bytes
font_01_sfnt_off00006869.bin
fd55b041121007e6d23368bf639a0421ac38aec4f823b783a1f85ca5daecfe50		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6869 16252 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.