Malicious PDF — malware analysis report

Static analysis result for SHA-256 f7123b01f9a9830b…

MALICIOUS

PDF

64.6 KB Authoring application: Pdftk First seen: 2020-12-25
MD5: 0925e3f60322079fae51345f757c6657 SHA-1: bd462689d2ce779acf81837aee10be12e3765198 SHA-256: f7123b01f9a9830bef7a3a6ac88e494ee674afab94c7adbab589cf340b10eaac
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded URLs pointing to other PDF files, a technique often used for SEO spam or to distribute malicious content. The ClamAV detection and ML classifier strongly indicate malicious intent. The embedded URLs are the primary IOCs, suggesting a link farm or content distribution network.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://wuzolopabe.svyazexpo-online.ru/uploads/2020/01/28/kofuretizamaz-libunepubunogek.pdf In PDF document text
    • http://curannahealing.com/uploads/1/3/0/6/130621021/3562369.pdfIn PDF document text
    • https://jewoluva.weebly.com/uploads/1/3/0/2/130273610/jepatadaneta_jevuwibigodeso_rilog_vetuk.pdfIn PDF document text
    • http://mumaja.zeeshanbuilds.site/uploads/2020/01/27/libola.pdfIn PDF document text
    • http://bobbybrown.org/uploads/1/3/0/5/130543093/436e313.pdfIn PDF document text
    • http://keizergunstore.com/uploads/1/3/0/6/130639183/da7c938.pdfIn PDF document text
    • https://virupadolek.weebly.com/uploads/1/3/0/4/130489039/a824c.pdfIn PDF document text
    • http://dazazuw.hayatim1film.com/uploads/2020/01/29/dotim_zurojotimozus.pdfIn PDF document text
    • http://tiffanycandles.net/uploads/1/3/0/2/130289277/ditezenifunewedi.pdfIn PDF document text
    • http://zofep.remsokna.ru/uploads/2020/01/28/1f4f95347556d.pdfIn PDF document text
    • https://liritawofilusi.weebly.com/uploads/1/3/0/2/130270847/fujulufolemoza.pdfIn PDF document text
    • http://nemuwalax.agicole-acces.com/uploads/2020/01/27/3453069.pdfIn PDF document text
    • http://mumezuwe.albertoleno.com/uploads/2020/01/27/mulivelamovigo_mabubiwux.pdfIn PDF document text
    • http://zejoxi.reshenie-krasnogorsk.ru/uploads/2020/01/27/f57391cbf0e.pdfIn PDF document text
    • http://aanddkin.com/uploads/1/3/0/5/130551319/torer_potuliveseleba_ragazazo_tarogepinobi.pdfIn PDF document text
    • http://rsigreen.com/uploads/1/3/0/3/130379428/c355852.pdfIn PDF document text
    • http://lesin.trubafasonka.ru/uploads/2020/01/28/bunivesefemokuvav.pdfIn PDF document text
    • http://recure.eu/uploads/1/3/0/6/130603836/130603836.html#common+idioms+in+american+english+pdfIn PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000015ea.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x15EA 8332 bytes
SHA-256: afb7e9d66c15b83cecdbe427bfad236bfc98717cbeef2c11d6f759c490b36f78

Open this report in the interactive analyzer, or submit your own file for analysis.