Malicious PDF — malware analysis report

Static analysis result for SHA-256 f6e32e58b6574e99…

MALICIOUS

PDF

41.9 KB Authoring application: Mobipocket Creator First seen: 2020-07-24
MD5: e648902a30cce921c2e771f945d420af SHA-1: 549141121c56e0baa52ceebb0847e7a884c8ef23 SHA-256: f6e32e58b6574e9969d95a2a207a483b67d7b1542fd974409cb4a116279d4dc5
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The file was detected as malicious by ClamAV and a machine learning classifier. The PDF contains a large number of external links to other PDF files hosted on various domains, indicating a link farm or distribution mechanism. This behavior is consistent with SEO manipulation or phishing campaigns aiming to redirect users to malicious content. No scripts were extracted, and the document body was heavily truncated, limiting further analysis of specific user-facing lures.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://reedsboutique.com/uploads/1/3/0/5/130588698/fifafitibimukonivage.pdf In PDF document text
    • http://kupoxafene.tsanfer.net/uploads/2020/01/28/19cb4d93d41881.pdfIn PDF document text
    • http://tebebafo.untieth.ru/uploads/2020/01/28/zutifodin-volom-nolobej-jovedaduzowom.pdfIn PDF document text
    • http://primepizza.info/uploads/2020/01/29/41d5a.pdfIn PDF document text
    • http://nowomerabo.tripmakanangin.com/uploads/2020/01/27/9e08542.pdfIn PDF document text
    • http://kebi.otzyvok.com/uploads/2020/01/28/norotisor_sasojogubupoxo.pdfIn PDF document text
    • http://0406shopps05.fun/uploads/2020/01/27/gofojokofibuxugiwo.pdfIn PDF document text
    • http://eifel-wohnmobil.de/uploads/1/3/0/4/130488063/1d1f97fc.pdfIn PDF document text
    • http://jug.provape.ru/uploads/2020/01/27/xofaju.pdfIn PDF document text
    • http://redfogentertainment.com/uploads/1/3/0/3/130313108/4187489.pdfIn PDF document text
    • http://jacquescampfineart.com/uploads/1/3/0/4/130491418/f12ac8f7.pdfIn PDF document text
    • https://jedusuxi.weebly.com/uploads/1/3/0/5/130589145/374a193b61c10.pdfIn PDF document text
    • http://pibibijal.prosportonline.ru/uploads/2020/01/28/jifak.pdfIn PDF document text
    • http://mrhowe.org/uploads/1/3/0/6/130620690/130620690.html#ejercicios+de+desigualdades+con+valor+absolutoIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001415.bin
60b842beecd02f968884811b734433947b088e4707e01a0e76526601cac26f34		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1415 9280 bytes
font_01_sfnt_off00005bed.bin
ef8cac21bf957d3c89121b38598f1a59c1f3108433020a7a53ffd8f097352ff6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5BED 16392 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.