Malicious PDF — malware analysis report

Static analysis result for SHA-256 d8535c811db62b5a…

MALICIOUS

PDF

44.1 KB Authoring application: SWFTools
MD5: d4f46ed19062707db4faab6855b16b50 SHA-1: 2be9c584c18e1d055d3b131c61a7f9727bc551ac SHA-256: d8535c811db62b5ae62fd0ef89e83b88165efb3df00fadf14aa3575b24fda094
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1566.002 Spearphishing Link

The PDF contains a large number of external links, as indicated by the PDF_SEO_LINK_FARM heuristic. The ClamAV detection and ML classifier also strongly suggest malicious intent. The embedded URLs point to various domains, suggesting a link farm or redirection scheme to distribute malicious content. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://barricas.nl/uploads/1/3/0/4/130483809/gevobidipepafafexid.pdf
    • http://newparentsconnect.com/uploads/1/3/0/6/130621443/01c0acf.pdf
    • http://rockandreverie.com/uploads/1/3/0/5/130589276/6772830.pdf
    • http://nononsensehomeinspection.com/uploads/1/3/0/6/130605273/zewawutoz.pdf
    • http://oaklandpoolcare.com/uploads/1/3/0/5/130543133/tageturupok.pdf
    • http://hellokendall.com/uploads/1/3/0/6/130603811/1026263.pdf
    • http://myxlplyx.com/uploads/1/3/0/2/130289519/zixufino_zekaxaset_widuwupoxuguwu.pdf
    • http://houstonofficespace.net/uploads/1/3/0/8/130814345/fobegixir-wovopuzu-reninikonosa-nemoxirajalob.pdf
    • http://www.bipolarstarguide.com/uploads/1/3/0/2/130288761/romugur-zelilujimoxa-mopadijuroxa-tamukuxugur.pdf
    • http://christidelnagro.com/uploads/1/3/0/6/130620869/dezikeduw-xogivape.pdf
    • http://my4health.com/uploads/1/3/0/5/130588693/kevufugurusomavu.pdf
    • http://mycleanohio.com/uploads/1/3/0/6/130605373/tedodube.pdf
    • http://mycampmate.com/uploads/1/3/0/7/130776326/tatupezusajipedibux.pdf
    • http://guardioesdeluz.com/uploads/1/3/0/6/130620970/sopobezuta_letevosokobo_vovimuwebexal.pdf
    • http://mywinningkidsseftworth.com/uploads/1/3/0/3/130323161/lidudu_vanikinoli_gefevewofewason.pdf
    • http://leadsolo.com/uploads/1/3/0/6/130621852/4734379.pdf
    • http://staurfoods.com/uploads/1/3/0/6/130621880/88386a.pdf
    • http://circushive.com/uploads/1/3/0/6/130604286/fipamibigemamun.pdf
    • http://promisewed.com/uploads/1/3/0/2/130291971/gifaligaxamuvuz-tavunuborojabo-juxeparek-rifenage.pdf
    • http://camilamcnemar.com/uploads/1/3/0/5/130541552/7379954.pdf
    • http://lattaconsultants.com/uploads/1/3/0/4/130483825/xixamuwito_vafox.pdf
    • http://amber-cano.rominastiebenphotography.com/uploads/1/3/0/4/130436209/130436209.html#rbse+11th+biology+book+free+download+pdf
    • http://houstonofficespace.net/uploads/1/3/0/8/130814345/fobegixir-wov

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002e8e.bin
43fa90f53ab3264d77b087d35e9720465b265e312f408f7e62407682aad12fef		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2E8E 10132 bytes
font_01_sfnt_off00004c19.bin
05fd7e868923059f6db48d0a6b8a861081ade5b8eb558b2d250422b6a73c6bd9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4C19 7720 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.