Malicious PDF — malware analysis report

Static analysis result for SHA-256 e6f4e0c2bf8f1ae0…

MALICIOUS

PDF

40.4 KB Authoring application: QPDF
MD5: 29066d78ff238bf7671f22881f7f1161 SHA-1: 94b0c7863f4a4431d58e3e17322ebf8f71532c86 SHA-256: e6f4e0c2bf8f1ae0b9a2f4ccf041a2cc5c4ba77620d20a5bde2bf079c9a37528
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded links, many of which point to suspicious domains, indicating a link farm for phishing or malware distribution. The ClamAV detection and ML classifier strongly suggest malicious intent. The document body, though heavily corrupted, appears to be a lure related to questionnaires, likely to trick users into clicking the malicious links.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://narkologiya-troick.ru/uploads/2020/01/29/legemivuvejapi.pdf
    • http://medojideb.privu.icu/uploads/2020/01/28/4a0af6d2c91363a.pdf
    • https://sowowufakumoju.weebly.com/uploads/1/3/0/6/130604456/gowebetakominu_wuroxenurege_xedivebopekogot.pdf
    • http://rosmedi.ru/uploads/2020/01/27/korewegekor.pdf
    • http://pay-pass.online/uploads/2020/01/27/ac47624aefac.pdf
    • http://wafazot.migraskop.com/uploads/2020/01/28/xenewixile-nevariw.pdf
    • http://jawatas.wiqox.xyz/uploads/2020/01/28/zibukije-dowem-gemazune-fekebedazutuxe.pdf
    • https://ragobiredufufaf.weebly.com/uploads/1/3/0/4/130483961/worinoxijefivonoz.pdf
    • https://dofujikofinaweb.weebly.com/uploads/1/3/0/3/130323412/ade4a04d3bc7d8.pdf
    • https://xozelagotak.weebly.com/uploads/1/3/0/4/130436122/1660720.pdf
    • http://sife.ag-interiors.com/uploads/2020/01/28/wifafabolosem.pdf
    • http://tijiv.otzyvok.com/uploads/2020/01/27/adb7ed37.pdf
    • http://bbcactioncourts.com/uploads/1/3/0/5/130588705/9162265.pdf
    • http://systema36.com/uploads/2020/01/27/zoburuxifavabevep.pdf
    • http://vexegiror.kaz24.com/uploads/2020/01/28/bikofuxovukalaxupu.pdf
    • https://baxodexuw.weebly.com/uploads/1/3/0/3/130313098/vebufedovazufopufu.pdf
    • https://julizivuzesu.weebly.com/uploads/1/3/0/5/130547069/rofagekokoberav.pdf
    • https://mopufojitapiwi.weebly.com/uploads/1/3/0/5/130589309/xarufopagenupun_lulesipifetunuw_piluxumujafu.pdf
    • https://gelotekurawanol.weebly.com/uploads/1/3/0/5/130589040/sasimaku.pdf
    • http://meessays.info/uploads/2020/01/28/22bc2133.pdf
    • http://seafoodfestivalgiveaways.com/uploads/1/3/0/3/130323469/130323469.html#social+impact+assessment+questionnaire+example
    • http://vexegiror.kaz24.com/uploads/2020/01/2

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000015d0.bin
c8675ca9b806de5b41db2c6812e18be99e89e81fde39ced79746911d0a4645de		 pdf-font-stream PDF embedded font (sfnt) at offset 0x15D0 7452 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.