Malicious PDF — malware analysis report

Static analysis result for SHA-256 06e78865fe4a1d62…

MALICIOUS

PDF

40.6 KB Authoring application: PDFedit
MD5: b7fcb1ed0b1eca0b63e0d0f44e9cba39 SHA-1: b501c891e1c29716ba3d9aff326e2f575b732cb8 SHA-256: 06e78865fe4a1d62acb9a82a207501c5d30d4c3bc4625ef9151955f587ae55bd
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links to external PDF files hosted on various domains. This behavior is indicative of a link farm, often used for SEO manipulation or to distribute further malicious content. The ML classifier and ClamAV detection strongly support the malicious nature of this file.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://wyandottespringsurbanfarm.com/uploads/1/3/0/3/130313541/7912314.pdf
    • http://designboxie.com/uploads/1/3/0/2/130272426/domef_reloxelu_jagazi.pdf
    • http://beachgrandma.com/uploads/1/3/0/7/130739577/534cb.pdf
    • http://bslartquilts.com/uploads/1/3/0/6/130620958/vujenikowegeduvap.pdf
    • http://xn--nuevavisin-obb.com/uploads/1/3/0/2/130288722/xizunusudufezitufa.pdf
    • http://employmentcentre.com.sg/uploads/1/3/0/6/130604466/kufatowovum_riguwajipuro.pdf
    • http://mylowvision.com/uploads/1/3/0/6/130621281/50bd992401324e.pdf
    • http://abraxasband.net/uploads/1/3/0/6/130620975/7393689.pdf
    • http://bodybydrea.net/uploads/1/3/0/4/130489833/zoravuz-xuxolulomuzi-muparidevubagew.pdf
    • http://theatrebrum.com/uploads/1/3/0/5/130590717/lolufuvepenu_gelikebomoxi_gugekitiw.pdf
    • http://happystraystories.com/uploads/1/3/0/6/130620952/muwalebikutisug.pdf
    • http://studentloandebtforums.com/uploads/1/3/0/7/130775590/5863233.pdf
    • http://almosteverything6dollars.com/uploads/1/3/0/3/130379333/9884430.pdf
    • http://webmail.kenreif.com/uploads/1/3/0/7/130776268/firexop-fajivavawuva-dimediguwika-demobuvo.pdf
    • http://coffeenashville.com/uploads/1/3/0/6/130605179/rudowumulugut.pdf
    • http://nethermossarchers.com/uploads/1/3/0/2/130287813/1881155.pdf
    • http://coremedicalassociates.com/uploads/1/3/0/4/130476440/rotet.pdf
    • http://morphmylogo.com/uploads/1/3/0/2/130272370/8d6959e3b626a.pdf
    • http://amazonverkaufsmaschine.com/uploads/1/3/0/2/130270904/45de4b4f312084.pdf
    • http://namdalseidmusikklag.no/uploads/1/3/0/7/130775370/48cf1c54.pdf
    • http://elrinteriors.com/uploads/1/3/0/6/130639411/2688650.pdf
    • http://cosmicbabies.org/uploads/1/3/0/6/130605256/nekogobokagixo.pdf
    • http://almanaquecircular.com/uploads/1/3/0/7/130776060/poxotuzifiro.pdf
    • http://palmspringsbachelor.com/uploads/1/3/0/6/130604950/0bbcb9a0aade.pdf
    • http://skepticbrain.com/uploads/1/3/0/5/130544352/f14a53836.pdf
    • http://lhkv4.salon225.com/uploads/1/3/0/7/130776607/130776607.html#emdr+therapy+for+ptsd+veterans

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003a87.bin
0c79900d4dd07adfd623972811ede01ca217825690696edc402f29fa2906f2f8		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3A87 7848 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.