Malicious PDF — malware analysis report

Static analysis result for SHA-256 e87d20a6d38a07e6…

MALICIOUS

PDF

44.7 KB Authoring application: Adobe PDF Library 9.0
MD5: 29400f243b660858aa35ef08b202bb5c SHA-1: d98957206238af60ccbd5ab80e113f92248d188c SHA-256: e87d20a6d38a07e699159be84fa9d0d91bc8faf1ad3257dfb70c0bfc0b2fb3be
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded URLs, identified by the PDF_SEO_LINK_FARM heuristic, pointing to external PDF documents. This suggests a link farm or a phishing lure designed to redirect users to potentially malicious content. The ML classifier and ClamAV detection further support its malicious nature. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://nextripchile.com/uploads/1/3/0/2/130270977/sejov.pdf
    • https://dobujiwade.weebly.com/uploads/1/3/0/4/130477048/sijababujutiro.pdf
    • https://jiwimuduwumib.weebly.com/uploads/1/3/0/6/130604911/zupexomezexok.pdf
    • https://rewixanenuk.weebly.com/uploads/1/3/0/2/130289266/naxejax_giwevapokes_labiromosivog_xivil.pdf
    • http://houseter.ru./uploads/2020/01/29/2338462.pdf
    • http://consciousnessnetwork.weebly.com/uploads/1/3/0/2/130287401/8df10a84e336404.pdf
    • http://indieconnectors.com/uploads/1/3/0/2/130270902/werumojujuw-kotafo.pdf
    • http://jasonwiff.com/uploads/1/3/0/5/130550711/mejuzeva-tofipala.pdf
    • http://nula.rostelekomo.info/uploads/2020/01/28/savozox.pdf
    • http://acat.limo/uploads/1/3/0/4/130483836/detegukim.pdf
    • http://pizaxewugu.acces-agicoles.com/uploads/2020/01/29/siguwekitabe-ridubip.pdf
    • http://paradigmfitness.net/uploads/1/3/0/2/130271185/tuzivi.pdf
    • http://pilatesandyogawithsharon.com/uploads/1/3/0/6/130639488/8d30658.pdf
    • http://ubezpieczeniatrawinski-chelmza.pl/uploads/1/3/0/2/130291441/kudutigexetada.pdf
    • http://steelcityselectsoftball.com/uploads/1/3/0/6/130620159/6832260.pdf
    • http://zefo.brothersrating.com/uploads/2020/01/29/1279773.pdf
    • http://moocpa.com/uploads/1/3/0/3/130379098/025d6fcc14.pdf
    • http://zudir.windowscaner.ru/uploads/2020/01/27/fukirunavowe_nilitolum_jisogijubezena_gidonofuju.pdf
    • http://golfoutingwizard.com/uploads/1/3/0/4/130483801/worebuzop-pufisegaperuta-xofis.pdf
    • http://rectaparrew.com/uploads/2020/01/28/9701490.pdf
    • http://vipiski-besplatno28.icu/uploads/2020/01/27/namogemad.pdf
    • http://mrsmeltabargersclass.com/uploads/1/3/0/6/130603961/powox-pipokirubafi.pdf
    • http://myrachelnewman.com/uploads/1/3/0/5/130551341/jesorifoz.pdf
    • http://misssoutheastpageantry.us/uploads/1/3/0/5/130539002/130539002.html#abecedario+ingles+espa%C3%B1ol+pdf

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001741.bin
9c6576ede61a914183b141fed3abebdc116818865b004a7cc528bfbd8c3dcd10		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1741 8776 bytes
font_01_sfnt_off000063d9.bin
4737b83fc1c9c83dcf3ab66fcb0939f03c9bf2164c9a6729ea83c3d2a6bec9a5		 pdf-font-stream PDF embedded font (sfnt) at offset 0x63D9 16944 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.