Malicious PDF — malware analysis report

Static analysis result for SHA-256 040d76581ba53a12…

MALICIOUS

PDF

49.1 KB Authoring application: Smallpdf Desktop
MD5: f54839039a903e46f806698fb28a5f14 SHA-1: 3a0c8a061038b573b174b83647ba60e5bf5b2299 SHA-256: 040d76581ba53a12965005c5bdf4de099985c033cd1b3f430e6f32e57c182f5f
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. The ClamAV detection and ML classifier also indicate maliciousness, specifically flagging it as phishing related. The primary attack pattern involves directing users to a multitude of PDF files hosted on various domains, which could be used for SEO spam or to distribute further malware.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cloverbend.com/uploads/1/3/0/2/130289719/dca4475.pdf
    • http://strongfamily.info/uploads/1/3/0/3/130323526/rifipomigokuforabefa.pdf
    • http://seattlebreastfeedinghikes.com/uploads/1/3/0/6/130639337/wonejul_lepujaw.pdf
    • http://connscorner.com/uploads/1/3/0/7/130739584/7312338.pdf
    • http://lawtavern.net/uploads/1/3/0/6/130604153/3437330.pdf
    • http://napacounty-rc.com/uploads/1/3/0/8/130813144/busolew-kegogeso.pdf
    • http://provasanteriores.net/uploads/1/3/0/3/130313149/495b6af2af9.pdf
    • http://kinneyllc.net/uploads/1/3/0/4/130483200/a2e1f453888.pdf
    • http://allabouthomerecording.com/uploads/1/3/0/8/130873876/goderajesunepuf_pumuju_jamam.pdf
    • http://bobslocker.com/uploads/1/3/0/2/130272356/tazudekira.pdf
    • http://bizania.org/uploads/1/3/0/6/130621502/1932239.pdf
    • http://lclreporter.com/uploads/1/3/0/6/130621369/wufiwunujeno.pdf
    • http://jointherescue.net/uploads/1/3/0/5/130588419/suwonobaxu.pdf
    • http://bneiakivadetroit.org/uploads/1/3/0/4/130483249/rexidapukiwa.pdf
    • http://lakewatchoutdoors.com/uploads/1/3/0/7/130775364/29f2f9cf.pdf
    • http://victoryhealthcarecenter.com/uploads/1/3/0/6/130621734/1105050.pdf
    • http://chunchorecords.com/uploads/1/3/0/6/130639129/jazalope-vojudixom-wupifag.pdf
    • http://norbertfodor.com/uploads/1/3/0/4/130483606/9095344.pdf
    • http://chewoncakes.com/uploads/1/3/0/6/130605422/130605422.html#a+discovery+of+witches+%282018%29

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006236.bin
6d0bd36e92aedc6626afd36cb1929d820ba1415b5b3b5901bbd0491908a0d690		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6236 8488 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.