Malicious PDF — malware analysis report

Static analysis result for SHA-256 ea932ad019b35917…

MALICIOUS

PDF

85.5 KB Authoring application: SWFTools
MD5: 3350b276f9910b36bf43f9dabe06be0c SHA-1: 1cf80e1169fe3e15e1b4951aacc07f836a6a4f4d SHA-256: ea932ad019b35917bb24878f8697d571e9f981592f1ab1b0074335c16c865dd1
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

This PDF file was identified as malicious by multiple heuristics and a machine learning classifier. It contains a large number of embedded URLs pointing to external PDF files, suggesting a link farm or redirection mechanism. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a phishing or traffic-generating intent. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://chrisfaraji.com/uploads/1/3/0/5/130588795/bojonavobilewid-pebota-kodigobuga.pdf
    • http://lajivawis.financebinom.info/uploads/2020/01/29/kakog_pigorute.pdf
    • http://kevinpistole.com/uploads/1/3/0/6/130640235/lebanironegas.pdf
    • http://nestgiftsdecor.com/uploads/1/3/0/3/130323806/60946e99647dd.pdf
    • http://discountclosetspecialist.com/uploads/1/3/0/6/130621665/8226169.pdf
    • http://curerecords.net/uploads/1/3/0/2/130288589/voterem.pdf
    • http://visionglobalcapital.org/uploads/1/3/0/6/130639600/15b45df9a1.pdf
    • http://richmondvideoservices.com/uploads/1/3/0/7/130738739/5234099.pdf
    • http://hazeltreeclinic.com/uploads/1/3/0/4/130489262/299509.pdf
    • http://deottoalberto.com/uploads/1/3/0/6/130640142/jivol.pdf
    • http://stayprotected.org/uploads/1/3/0/3/130323709/takawatusiv.pdf
    • http://christinabarsi.net/uploads/1/3/0/6/130604981/vekenudiburap.pdf
    • http://neokundalini.org/uploads/1/3/0/7/130740218/130740218.html#%D9%83%D9%8A%D9%81%D9%8A%D8%A9+%D8%A7%D9%84%D8%AD%D8%B5%D9%88%D9%84+%D8%B9%D9%84%D9%89+%D8%AA%D8%B3%D8%A7%D9%87%D9%84+%D8%A7%D9%84%D8%AC%D9%84%D8%B3%D8%A9+%D8%A7%D9%84%D8%B9%D8%A7%D9%85%D8%A9

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off0000eae8.bin
6de27808c06362568dd873e4c7806f883de11ec498eb2b04c56e8a2586231351		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0xEAE8 33884 bytes
font_00_sfnt_off000014c1.bin
7cc561a59a715067993987a19cb8cd661b24884b6977c336617caaf60f554a56		 pdf-font-stream PDF embedded font (sfnt) at offset 0x14C1 7568 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.