Malicious PDF — malware analysis report

Static analysis result for SHA-256 e9f25eff734db441…

MALICIOUS

PDF

35.8 KB Authoring application: SWFTools
MD5: acd516ab0c19ae253f9883817929360b SHA-1: 21202dc96ab8e848771f23724b82a89b6425f1de SHA-256: e9f25eff734db4417a27bc4346971309bb2957a2e00fe15957de386820ed821e
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file was flagged by ClamAV as Pdf.Phishing.TtraffRobotInstall and a machine learning classifier with high confidence. The primary heuristic indicates a large number of external PDF links, suggesting a link farm or SEO manipulation tactic. The document body contains references to 'Supermatch telefe capitulos completo' and includes numerous URLs pointing to other PDF files, reinforcing the link farm hypothesis. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://altaisk22.ru/uploads/2020/01/27/kadigatatidolulu.pdf
    • http://ker.difmed.com/uploads/2020/01/27/mepivate.pdf
    • http://pama.stroy-city.online/uploads/2020/01/27/372439.pdf
    • http://roxandsol.com/uploads/1/3/0/2/130270934/ribajuka-wofuk.pdf
    • https://fafixelu.weebly.com/uploads/1/3/0/4/130435795/jikatav.pdf
    • http://tacoselcuate.com/uploads/1/3/0/6/130620387/9125628.pdf
    • http://nexog.motorolka.ru/uploads/2020/01/29/4319220bec7ef2.pdf
    • https://nomodejupabaw.weebly.com/uploads/1/3/0/3/130313191/dafofijozadidur-makuxugug.pdf
    • http://fixodu.mbsmun.site/uploads/2020/01/27/775480.pdf
    • http://adventuresinfaith.org/uploads/1/3/0/5/130539348/98819e923e.pdf
    • http://nealcm.com/uploads/1/3/0/2/130272603/pularozinam.pdf
    • http://riwadupo.supersfereon.fun/uploads/2020/01/29/53f34da9f23a.pdf
    • https://fegefelulijij.weebly.com/uploads/1/3/0/2/130273582/vupum.pdf
    • http://russopera.ru/uploads/2020/01/28/bc8cefc3bbf.pdf
    • https://wufibirexuxolug.weebly.com/uploads/1/3/0/5/130539928/59363.pdf
    • http://jujoxawuf.lifetime24.ru/uploads/2020/01/27/denuwa.pdf
    • http://avon-lider.com/uploads/2020/01/29/vuvawowugigig_xabago_salodowubor.pdf
    • https://dizorawigetaxes.weebly.com/uploads/1/3/0/5/130539408/8856647.pdf
    • http://easygo.tech/uploads/2020/01/27/wutumavix.pdf
    • https://vijirenepejix.weebly.com/uploads/1/3/0/5/130589057/bonixalexitatiz.pdf
    • http://pirozolujo.tell-to.ru/uploads/2020/01/27/lemesema.pdf
    • http://1posvetu.com/uploads/2020/01/27/1357880.pdf
    • http://eco-tone.ru/uploads/2020/01/28/zepetakaro_gudaw_jejimufix_sagufanev.pdf
    • http://thevoodooboneladyvoodooshop.com/uploads/1/3/0/5/130588839/ce507ff9eddec70.pdf
    • http://djsacademy.com/uploads/1/3/0/5/130588551/130588551.html#supermatch+telefe+capitulos+completo

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000016f2.bin
9467c0cd6959f477c741bd7e6035ec3c0066afa50aca9818c7eb720e05816f9d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x16F2 8668 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.