Malicious PDF — malware analysis report

Static analysis result for SHA-256 e584e2eeefe6ace6…

MALICIOUS

PDF

46.3 KB Authoring application: PDFBox
MD5: a9565a842d6d02eea40fccfb42de3a8f SHA-1: 8d57ef80570e59816f5beb8cf32c503d51bd7f02 SHA-256: e584e2eeefe6ace64c3e262345882d2b486a439e5ce24c07b0308d0be0476cb3
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1566.002 Spearphishing Link

The PDF contains a large number of embedded URLs, identified by the PDF_SEO_LINK_FARM heuristic, pointing to external PDF files. This suggests a link farm or phishing campaign designed to drive traffic to numerous sites. The ClamAV detection and ML classifier further support its malicious nature. No scripts were extracted, and the document body was heavily obfuscated, limiting further analysis of the specific lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://letssimplify.us/uploads/1/3/0/6/130603927/noxabew.pdf
    • https://manupezali.weebly.com/uploads/1/3/0/3/130313173/f8880c.pdf
    • http://bigijav.mosinztorg.ru/uploads/2020/01/28/zejopanubo.pdf
    • http://whiteglovetreatmentllc.net/uploads/1/3/0/6/130605166/dabafexesele-fapig.pdf
    • https://jiwakefe.weebly.com/uploads/1/3/0/4/130483918/wutevemumi.pdf
    • http://lilaclighthouse.com/uploads/1/3/0/4/130476192/1521039.pdf
    • https://xetiratid.weebly.com/uploads/1/3/0/5/130550976/cddbfc8d9.pdf
    • https://tamufofaxedosul.weebly.com/uploads/1/3/0/4/130483537/xaniwotosaremuga.pdf
    • http://rafa.monnouveauportable.com/uploads/2020/01/28/63549d668d0fefe.pdf
    • http://kdbryanauthor.com/uploads/1/3/0/3/130379798/92050.pdf
    • http://vad.lavka-med.ru/uploads/2020/01/28/gemeg.pdf
    • http://wipaga.malakut911.com/uploads/2020/01/27/mikilusofujoko.pdf
    • http://asharedjourney2018.com/uploads/1/3/0/3/130313022/0b0c9299.pdf
    • http://ponufanuwu.chess-nut.com/uploads/2020/01/27/7662882.pdf
    • http://minoritypodcast.com/uploads/1/3/0/4/130476878/6805403.pdf
    • http://christcenteredironwares.com/uploads/1/3/0/2/130270945/pilofu.pdf
    • http://bestyethomeimprovement.com/uploads/1/3/0/4/130477192/5324396.pdf
    • http://jota.voloklinik.com/uploads/2020/01/28/punubiwumik.pdf
    • http://music-kidskola.com/uploads/2020/01/28/furabosaxom.pdf
    • http://kayekearnsesthetics.com/uploads/1/3/0/6/130621485/4f774e0e.pdf
    • http://kazonopu.marcketplace.online/uploads/2020/01/27/5014309.pdf
    • http://nux.rentwarepreview.tech/uploads/2020/01/27/1606455.pdf
    • http://jumikopito.diamantevidrosweb.site/uploads/2020/01/27/vipodu.pdf
    • http://jobax.z-kiski.fun/uploads/2020/01/27/fapawopafev-puxeneluwig-bifunizafavajus-nivavibe.pdf
    • https://tewozonixub.weebly.com/uploads/1/3/0/6/130604110/03b494b5c03abb8.pdf
    • http://greenwolfverticalfarm.com/uploads/1/3/0/6/130621003/130621003.html#mis+sentimientos+err%C3%B3neos

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000018e5.bin
bf3656dbc46ca0fbe4c29321331fa23e2ae8f115d15395f91238ad334aad1ee7
pdf-font-stream PDF embedded font (sfnt) at offset 0x18E5 8316 bytes
font_01_sfnt_off000064c8.bin
e91619dfd4c72a85464d95ef1ba4e67df13020651c42071bafbe521a61d9f7fc
pdf-font-stream PDF embedded font (sfnt) at offset 0x64C8 2652 bytes
font_02_sfnt_off00006d94.bin
779aa567746046747dac965df7fdfb06ff632674a0a99ce247a327bf89f0fa63
pdf-font-stream PDF embedded font (sfnt) at offset 0x6D94 16036 bytes