Malicious PDF — malware analysis report

Static analysis result for SHA-256 d79b32f07d44ab04…

MALICIOUS

PDF

45.7 KB Authoring application: SWFTools First seen: 2020-09-04
MD5: 44f7d8f34043fdaba01dda77b533c3cb SHA-1: 963077bc90c9e367b95af49a8d64009ebb8edf4d SHA-256: d79b32f07d44ab044000d993ea11671d9f1ba31d4423501fb68f108d1e8cf8ff
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Phishing: Spearphishing Attachment T1059.001 Command and Scripting Interpreter: PowerShell

The PDF file contains a large number of embedded URLs pointing to other PDF files across numerous domains. This behavior is indicative of a link farm or a distribution mechanism for further malicious content, as suggested by the 'PDF_SEO_LINK_FARM' heuristic. The ClamAV detection also flags it as phishing-related. No scripts were extracted from this sample, limiting the ability to determine specific payload delivery or execution methods.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://mysticgardentw.com/uploads/1/3/0/6/130603782/f9d3b3383.pdf In PDF document text
    • http://gow.turizmtlt.ru/uploads/2020/01/28/luzabeda.pdfIn PDF document text
    • http://cartonone.com/uploads/1/3/0/2/130270924/zurizijar.pdfIn PDF document text
    • https://putajuniponi.weebly.com/uploads/1/3/0/5/130539658/9309916.pdfIn PDF document text
    • http://rolandandcaroline.com/uploads/1/3/0/4/130475964/4265177.pdfIn PDF document text
    • http://zewo.dateurbate.club/uploads/2020/01/29/909badafe2b.pdfIn PDF document text
    • http://ruwonup.rurostelekomk.ru/uploads/2020/01/27/wudubo.pdfIn PDF document text
    • http://100wwclickingcounty.org/uploads/1/3/0/2/130287847/lofitamunivinivi.pdfIn PDF document text
    • http://lidew.iamhasan.com/uploads/2020/01/27/3597033.pdfIn PDF document text
    • http://jowujekija.agicole-acces.com/uploads/2020/01/27/buxinuweti.pdfIn PDF document text
    • https://varobefixuwatab.weebly.com/uploads/1/3/0/4/130435670/pafibinotugos_saguv.pdfIn PDF document text
    • http://kibedu.aroxj.info/uploads/2020/01/28/79ad13b9a368e.pdfIn PDF document text
    • http://detourtowonderland.com/uploads/1/3/0/3/130313427/4542969.pdfIn PDF document text
    • http://gixowuned.gk-absolutstroy.ru/uploads/2020/01/27/nixip.pdfIn PDF document text
    • http://sedusije.hopifai.info/uploads/2020/01/28/lisoruwutitizukalof.pdfIn PDF document text
    • http://foko.emaxb.com/uploads/2020/01/28/8474998.pdfIn PDF document text
    • http://zozavudiw.rennessans.com/uploads/2020/01/28/tifibumit.pdfIn PDF document text
    • http://masterpechi.ru/uploads/2020/01/28/jofemafux.pdfIn PDF document text
    • http://rabijaje.onlyoil.ru/uploads/2020/01/28/sitoxelusa.pdfIn PDF document text
    • http://theinnonsilverlake.com/uploads/1/3/0/5/130590637/fezemiponix_xiriwupes_valaju.pdfIn PDF document text
    • https://volepogopomara.weebly.com/uploads/1/3/0/4/130489536/a836faa2a.pdfIn PDF document text
    • http://vuzoke.rttelekom.info/uploads/2020/01/28/4062199.pdfIn PDF document text
    • http://lovewarrioryogaschool.com/uploads/1/3/0/5/130539225/130539225.html#jesus+calling+august+29In PDF document text
    • http://linux.thai.net/projects/fonts-tlwgIn PDF document text
    • http://www.thaitux.infoIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000162d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x162D 7892 bytes
SHA-256: cb40935ccffd0077e372d44796c954328333610bdd0091f18c1dbaffa8ce7c0b
font_01_sfnt_off0000629a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x629A 13116 bytes
SHA-256: fac38433125b026a93ccf7d28d93a1c45c6e5eb06370aed4cdb2a5f713cb8396

Open this report in the interactive analyzer, or submit your own file for analysis.