Malicious PDF — malware analysis report

Static analysis result for SHA-256 d8d0260ecd74f30b…

MALICIOUS

PDF

44.6 KB Authoring application: ImageMagick
MD5: c73c1e0790792baf2ebe1ab5bae4c547 SHA-1: 6119eed097edaeba2dafad381685d85c83796cb2 SHA-256: d8d0260ecd74f30b5a7f93bd4f3f98df1122836208c37d7d300adecc528b1ecf
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic, pointing to other PDF files. The ML classifier and ClamAV detection strongly indicate maliciousness, with ClamAV identifying it as phishing-related. The embedded URLs suggest a phishing or malware distribution campaign.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9988

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://boxagiv.vipiski-besplatno52.icu/uploads/2020/01/28/nogijadujani.pdf
    • http://boldbelize.com/uploads/1/3/0/6/130620575/cb222bff4a.pdf
    • https://jemijeku.weebly.com/uploads/1/3/0/3/130323232/f127807aa.pdf
    • https://newapotunok.weebly.com/uploads/1/3/0/2/130289436/9732434.pdf
    • http://usaharumahku.weebly.com/uploads/1/3/0/4/130435646/a6daea07f0.pdf
    • http://micasabali.com/uploads/1/3/0/3/130313230/4445942.pdf
    • http://lincoln-landscaping.com/uploads/1/3/0/6/130621965/rilawujupiguvupebemu.pdf
    • https://kiwoxugaxis.weebly.com/uploads/1/3/0/2/130272979/5606787.pdf
    • http://johnhenryfox.com/uploads/1/3/0/6/130620801/gijapaladobi-bixumab-vulumepa.pdf
    • http://mscmyservicecleaning.com/uploads/1/3/0/6/130604549/medelifubesuwux.pdf
    • http://sweetestdreams.org/uploads/1/3/0/5/130550736/130550736.html#74155+decoder+ic+datasheet

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000013a9.bin
c02e6849ee996558ae3bcd9687b542cc59feda5cfe3fa0e47442050842974b05		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13A9 7872 bytes
font_01_sfnt_off000040ba.bin
c9655644a945a2bc46672e4d4588f8b8f0381e8adfc868cce1c18b57f13076a9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x40BA 9744 bytes
font_02_sfnt_off000054e6.bin
76d0edce5bdb93a691a0309c49e7369480f5d97eef5486ab960fc16df6d92a06		 pdf-font-stream PDF embedded font (sfnt) at offset 0x54E6 16384 bytes
font_03_sfnt_off00006a6b.bin
c9f2766864d727e1393aa645f689f1e349cca9ca80d00af93de57b1bbf7dc8a8		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6A6B 5532 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.