Malicious PDF — malware analysis report

Static analysis result for SHA-256 e60442b9de15699c…

MALICIOUS

PDF

40.0 KB Authoring application: SWFTools
MD5: d6c4b697ca00706e854f0db6553f63e7 SHA-1: 6a519bc88d22f23fd1f543824b13a936f10c91fb SHA-256: e60442b9de15699c815acb49899da4463bdcef8b7086bb18b7f9db1716e18de2
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a mass external link farm, directing users to multiple malicious PDF files hosted on various domains. The document body, despite being heavily obfuscated, mentions 'Improve critical thinking skills nursing' as a lure. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the ML classifier strongly indicate malicious intent, likely for phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://help-bank.ru/uploads/2020/01/28/nowimaruxekorojebak.pdf
    • http://agm28.icu/uploads/2020/01/28/d14479ca7ac9ad.pdf
    • http://micah-stephens.com/uploads/1/3/0/5/130588343/6368038.pdf
    • http://puttingontheglitzlm.com/uploads/1/3/0/5/130541745/6855031.pdf
    • http://mountyhorseandsports.com/uploads/1/3/0/5/130540049/wamoja.pdf
    • http://noraleefashion.com/uploads/1/3/0/5/130539270/ea5a813.pdf
    • http://weekeepcompany.com/uploads/1/3/0/2/130287419/6c01b4a12f15c0.pdf
    • http://nwintegrativeprimarycare.com/uploads/1/3/0/2/130272233/daca0e0d1b2f.pdf
    • http://okpins.net/uploads/1/3/0/6/130639309/276131.pdf
    • http://ashtaashram.com/uploads/1/3/0/2/130272084/zuzinixumobolof.pdf
    • http://bcssummerlanguagecamp.com/uploads/1/3/0/5/130539797/130539797.html#improve+critical+thinking+skills+nursing

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001217.bin
ee4c234c1f0588b23ce5d05737866ef2062f3b853bee949f0e734a117f793430		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1217 8088 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.