Malicious PDF — malware analysis report

Static analysis result for SHA-256 02858949f2eda966…

MALICIOUS

PDF

42.1 KB Authoring application: Nitro PDF
MD5: 03d9c4372b7c43838a4ee5d5e9e09576 SHA-1: 451e6ddb1ecf6278769efad9a394bbc3e6d06992 SHA-256: 02858949f2eda966b842c920fe279444d9b852dc4bf5918957afb1377660d74a
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF contains a large number of embedded URLs pointing to external PDF files, a technique often used for SEO manipulation or to distribute further malicious content. ClamAV detected this file as 'Pdf.Phishing.TtraffRobotInstall-7605656-0', and a critical heuristic identified it as a PDF link farm. The ML classifier also flagged it with high confidence.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.360warriors.com/uploads/1/3/0/9/130969874/mumenorilokeberin.pdf
    • http://28bullets.com/uploads/1/3/0/6/130620963/2809604.pdf
    • http://www.learnthebibleinayear.org/uploads/1/3/0/8/130814189/0d10a2dd.pdf
    • http://soundanddoctrine.com/uploads/1/3/0/4/130476043/sexonilekavapaxa.pdf
    • http://spotlightchildrenstheater.com/uploads/1/3/0/4/130476171/dfa8439bb.pdf
    • http://advancedrxtestwebsite.com/uploads/1/3/0/2/130271205/9330977.pdf
    • http://mta-sts.cirkas.info/uploads/1/3/0/5/130543087/7857465.pdf
    • http://www.shareejfennell.com/uploads/1/3/0/6/130603935/3245672.pdf
    • http://mobilizerrs.com/uploads/1/3/0/8/130814432/niwajodefi.pdf
    • http://micheleblancpain.com/uploads/1/3/0/2/130271113/4552436.pdf
    • http://www.m7mdalansari.com/uploads/1/3/0/6/130621006/juduvajefopepi_butetuxokuval_gumopazo.pdf
    • http://rebellecollectivegroup.com/uploads/1/3/0/5/130547024/muxolelatosep_putomegivebu_fofoligig.pdf
    • http://www.educationinequality.com/uploads/1/3/0/2/130270955/5eb64b.pdf
    • http://oacmedicalspa.ca/uploads/1/3/0/6/130620579/bapenafe.pdf
    • http://www.lidoasteria.com/uploads/1/3/0/5/130588654/vutewibezuxanuw.pdf
    • http://chicklit.info/uploads/1/3/0/2/130287529/rujadajerip-rulare.pdf
    • http://www.southcentraldragracing.com/uploads/1/3/0/5/130588559/gomuzuteda.pdf
    • http://lyona.org/uploads/1/3/0/6/130620601/5227297.pdf
    • http://www.dailyherbs.eu/uploads/1/3/0/8/130874133/130874133.html#hydroponics+vs+aquaponics+vs+aeroponics

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004611.bin
747557c96aeabb857433dfc4fc9c6b1cf3b139f63535ac8aeb7ed4ef931c9dbd		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4611 8372 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.