Malicious PDF — malware analysis report

Static analysis result for SHA-256 dc9a46ffd8d6dcef…

MALICIOUS

PDF

45.7 KB Authoring application: pstoedit
MD5: d95578d12f2df0384a6b619e46e1b2df SHA-1: 465065cfa5dd6f294a3ff0a541da5af86178d29e SHA-256: dc9a46ffd8d6dceffe8ae35fdc0fb303eeba16e9ec288b332e34f665b409da47
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links to external PDF files, a technique often used for SEO poisoning or to distribute malicious content. The ClamAV detection and ML classifier strongly indicate malicious intent. The embedded URLs are the primary indicators of compromise, suggesting a delivery mechanism for further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://bipegid.osoznanie.online/uploads/2020/01/28/56e733625.pdf
    • http://walnutstreetcoc.com/uploads/1/3/0/4/130435783/2735061.pdf
    • http://timehygiene.com/uploads/1/3/0/4/130489398/zukutekifixuz.pdf
    • http://hnhojjat.com/uploads/2020/01/28/doniruru.pdf
    • https://jonibined.weebly.com/uploads/1/3/0/5/130589397/bbf7bd4.pdf
    • https://mamelijedudi.weebly.com/uploads/1/3/0/3/130324136/4205104.pdf
    • https://bejewimoj.weebly.com/uploads/1/3/0/5/130590613/b074eaa2d71e.pdf
    • https://pinikajawixo.weebly.com/uploads/1/3/0/4/130483616/tozukidakasises.pdf
    • http://nubexavel.trubdesign.com/uploads/2020/01/29/tevopodidukine.pdf
    • http://nilos.onemagazin.ru/uploads/2020/01/27/8223387.pdf
    • http://kebaj.kzcoinex.com/uploads/2020/01/27/rufamutexul-zesosoviju-kikilopu.pdf
    • http://rerokeki.hallo-mensen.com/uploads/2020/01/28/wuposogusawis.pdf
    • https://renibetogakuzu.weebly.com/uploads/1/3/0/4/130476492/eb99136bd1e1e5.pdf
    • http://jpconseil.eu/uploads/1/3/0/4/130483320/zetijikav.pdf
    • http://stemteachershou.net/uploads/1/3/0/5/130540824/8bad238e5d2eba.pdf
    • http://xefip.shopdochoi.tech/uploads/2020/01/27/kikowetovobetun.pdf
    • http://evokefitness.net/uploads/1/3/0/2/130288465/130288465.html#projeciologia+waldo+vieira+download

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000014fe.bin
3f35c1d07114959d97a787fe2fa93a63a9cd9f122dbab882def0805d09cbf5b4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x14FE 10496 bytes
font_01_sfnt_off0000698b.bin
598b436daaf3d122157f8aae4d95cb5f98998d7541b527c84c982bd0659a624f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x698B 16888 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.