Malicious PDF — malware analysis report

Static analysis result for SHA-256 0660ea915001c9a1…

MALICIOUS

PDF

53.8 KB Authoring application: Adobe PDF Library 9.0
MD5: 23631beda7a94036150ed884d5fee888 SHA-1: 82ddc283e6cde64376f77842232c07372409821d SHA-256: 0660ea915001c9a1e555c596db97af2b0f3ffaff5ab19763fda6c088d2aef6ca
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains a large number of embedded links to external PDF files hosted on various domains. This behavior is indicative of a link farm or a distribution mechanism for further malicious content, as suggested by the 'PDF_SEO_LINK_FARM' heuristic and ClamAV detection. While no scripts were explicitly extracted, the embedded URLs are the primary indicators of malicious intent, likely serving as a lure or a method to spread malware.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://hotelnauvoo.net/uploads/1/3/0/7/130739499/jesumakovapu.pdf
    • http://declareyourday.com/uploads/1/3/0/2/130292110/zepibezemudafuwum.pdf
    • http://kidsandcaregivers.org/uploads/1/3/0/3/130313293/josov_sabinabox.pdf
    • http://harrisonneese.com/uploads/1/3/0/2/130270980/5e216ea8b4472a.pdf
    • http://nathanieltrevino.net/uploads/1/3/0/7/130740292/1617471.pdf
    • http://goldcoastconsulting.org/uploads/1/3/0/5/130545884/c8a6af0487f.pdf
    • http://www.melanieartist.com/uploads/1/3/0/6/130639300/dalupukavaludagatofo.pdf
    • http://mindful-empowerment.ca/uploads/1/3/0/4/130488396/957decb.pdf
    • http://testvocabulary.com/uploads/1/3/0/7/130739517/7442639.pdf
    • http://www.fashionblitz.org/uploads/1/3/0/6/130639385/kefidiwufuxide-robowejilixose-wufijodira.pdf
    • http://eleganttouchhealthcare.org/uploads/1/3/0/7/130776420/jafadiwusiziwudufu.pdf
    • http://cancerblingshop.com/uploads/1/3/0/7/130738996/5653008.pdf
    • http://nicolecthomaswrites.com/uploads/1/3/0/6/130640114/murodoxeka_pinurike_xudoruzo.pdf
    • http://gps4careers.org/uploads/1/3/0/2/130287279/8202426.pdf
    • http://jimmyplease.com/uploads/1/3/0/5/130588686/6717e28c6.pdf
    • http://makervet.com/uploads/1/3/0/6/130621086/5695698.pdf
    • http://insightin2music.com/uploads/1/3/0/4/130483158/130483158.html#betty+and+jughead+in+archie+comics

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001081.bin
8827fbc74392f7667d3e04b308396ceaab94fd5c448d0d9e56e0e419d972548c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1081 8656 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.