Malicious PDF — malware analysis report

Static analysis result for SHA-256 00eaa1d8992099ad…

MALICIOUS

PDF

42.8 KB Authoring application: Pdftk
MD5: aef47cdd6c0bb59448a391ff1a555173 SHA-1: a110087397fa9777949ee9b8f64fd0312374432e SHA-256: 00eaa1d8992099ad451a02d97be12b8808db64b17d8cb8da17450009a1f84d38
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF document contains a large number of embedded links to external PDF files hosted across various domains. This behavior is indicative of a link farm or redirection scheme, likely intended to lead users to malicious content or phishing pages. The ML classifier and ClamAV detection strongly support its malicious nature.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://abileneallies.com/uploads/1/3/0/2/130287977/kasarebog.pdf
    • http://nicole-florio.com/uploads/1/3/0/5/130540869/4541406.pdf
    • http://seelooinc.com/uploads/1/3/0/5/130540406/gaperuposig_kubuxitap_kezinonagige_wesutotifupi.pdf
    • http://dmitrithompson.com/uploads/1/3/0/8/130874136/wapobeworanuwuzap.pdf
    • http://bethegoodhands.com/uploads/1/3/0/5/130588907/54a83.pdf
    • http://www.energohubsg.com/uploads/1/3/0/5/130551049/bc120a0b5b.pdf
    • http://myeasystudy.com/uploads/1/3/0/5/130589040/fabagugeze-zagal-rovogesitojuwax-wegax.pdf
    • http://attorneygarvey.com/uploads/1/3/0/3/130323475/dimelomelo.pdf
    • http://domainchangers.com/uploads/1/3/0/4/130479350/fuluzabuvup_rojav_zazexigadez.pdf
    • http://michiganroofmasters.com/uploads/1/3/0/4/130435791/zunomepowila.pdf
    • http://mta-sts.mail.granolaee.com/uploads/1/3/0/4/130477192/kikogifadizotu-doxovikafewal-jopugerazesoloj-wadumobiva.pdf
    • http://agrseedandsupply.com/uploads/1/3/0/8/130814967/jegal-kuboxedanej-lonivamivarap-nasodunaw.pdf
    • http://ninagandhi.net/uploads/1/3/0/5/130588508/tenebo_fazim_pepogozore.pdf
    • http://lloretnews.com/uploads/1/3/0/7/130776175/f6213bed.pdf
    • http://beyondsoftware.com/uploads/1/3/0/6/130621273/fepono-xulogeravuf.pdf
    • http://countingwithelliot.com/uploads/1/3/0/2/130289571/geralejepuder.pdf
    • http://priyabery.com/uploads/1/3/0/6/130620370/6021580.pdf
    • http://nightingaleicecreamsandwiches.com/uploads/1/3/0/6/130639222/mudosa_xafowuneg_geferog.pdf
    • http://nysmaplepartridge.com/uploads/1/3/0/7/130739850/tugozasebopor.pdf
    • http://roxandree.com/uploads/1/3/0/6/130604336/5401268.pdf
    • http://replicatorsystems.com/uploads/1/3/0/6/130639360/2937584.pdf
    • http://vesselhouse.co/uploads/1/3/0/8/130814192/c0cd1328.pdf
    • http://nathanielrichguitars.com/uploads/1/3/0/2/130272385/5129342.pdf
    • http://checksymptom.com/uploads/1/3/0/7/130774973/dekageza_nagudi.pdf
    • http://mondokdentalmexico.com/uploads/1/3/0/2/130291673/kufekeribeb_vasavifoso.pdf
    • http://she169.brdge.org/uploads/1/3/0/6/130620965/130620965.html#s+bahn+fahrplan+berlin+spandau

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004058.bin
eda0c901f76488cbb4699fb87bb56b7c7d96849b4bc4dd26e6b24443bdfe1227		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4058 9232 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.