Malicious PDF — malware analysis report

Static analysis result for SHA-256 0ba67350867399af…

MALICIOUS

PDF

38.7 KB Authoring application: pdf-parser
MD5: fbec5b888006fedafc200f363de173c8 SHA-1: 034a9b7a30ab6834f1a137179f4ae9775203b8ca SHA-256: 0ba67350867399af2b093cdfa72da9c3223e0758672838c106f6b3ce92f58feb
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded URLs, many of which follow a pattern of linking to other PDF files on various domains. This behavior is indicative of a link farm designed to distribute malicious content, as flagged by the PDF_SEO_LINK_FARM heuristic. The ML classifier and ClamAV detection further support its malicious nature, identifying it as a phishing or malware distribution attempt. The embedded URLs likely serve as a lure to download further malicious payloads.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://jingarrigue.com/uploads/1/3/0/2/130288722/e47b011e.pdf
    • http://letuscallforyou.com/uploads/1/3/0/2/130272280/tupulutexofu-budilut.pdf
    • http://buy-ritehomes.com/uploads/1/3/0/6/130639398/12f01.pdf
    • http://castlepinesvillagegardenclub.org/uploads/1/3/0/7/130776085/jupivam-burokul.pdf
    • http://stevenyasell.com/uploads/1/3/0/4/130435943/7122446.pdf
    • http://villagetossandtumble.com/uploads/1/3/0/6/130621775/donuberigipe_jowobabebeged_pupiwi.pdf
    • http://myangelabartlett.com/uploads/1/3/0/6/130620578/d7534f07ebea7.pdf
    • http://longhollow.net/uploads/1/3/0/5/130551994/398523606b309.pdf
    • http://hailey-mcdermott.com/uploads/1/3/0/3/130323449/8586606.pdf
    • http://ineedexercise.com/uploads/1/3/0/6/130639281/ladotubasumes.pdf
    • http://metropolis-exc.com/uploads/1/3/0/4/130488415/soluvu.pdf
    • http://autodiscover.lancerpep.org/uploads/1/3/0/6/130620667/1247799.pdf
    • http://myberrygoodlife.com/uploads/1/3/0/6/130604283/5348326.pdf
    • http://saloteflorist.com/uploads/1/3/0/7/130775195/2888058.pdf
    • http://forthegreens.com/uploads/1/3/0/4/130488964/1374437.pdf
    • http://sparkfizz.net/uploads/1/3/0/5/130588663/046cf.pdf
    • http://amgreal.com/uploads/1/3/0/6/130604533/solupakozopi_jibarus_fomenime_newas.pdf
    • http://ororossodelmonferrato.com/uploads/1/3/0/2/130272372/vidaxo.pdf
    • http://lovelykacie.com/uploads/1/3/0/7/130776649/lubej.pdf
    • http://calebcluff.com/uploads/1/3/0/4/130483514/dazexefanebiselopiw.pdf
    • http://hiltonheadinternists.com/uploads/1/3/0/6/130605292/6014500.pdf
    • http://michiganinsuranceguru.com/uploads/1/3/0/6/130621149/c26b4d6ed0c57.pdf
    • http://thermofaxscreens.com/uploads/1/3/0/2/130288673/9200714.pdf
    • http://ketoqr.com/uploads/1/3/0/7/130739379/d78a2d5952b17.pdf
    • http://msgland.com/uploads/1/3/0/8/130813783/5480952.pdf
    • http://shopjollygoods.com/uploads/1/3/0/8/130874485/130874485.html#ncert+english+grammar+book+class+8+pdf

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000033f7.bin
7beb9da8fd03d73715e3bfc8226e91ae484df88b384a4253fcab85769eea9d57		 pdf-font-stream PDF embedded font (sfnt) at offset 0x33F7 7532 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.