Malicious PDF — malware analysis report

Static analysis result for SHA-256 0d14c397e149405d…

MALICIOUS

PDF

37.4 KB Authoring application: pdf-parser
MD5: 13a57da58bd3a0bb56730674c75be092 SHA-1: 0486ff09b0e1c7b89b68ad6fe174f8587a169cab SHA-256: 0d14c397e149405d36c2558b4da6d8a79250cf371a765453fcaa57e422a33b66
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded URLs, forming a link farm. This is a common technique used in phishing campaigns or to distribute malware by redirecting users to malicious sites. The ClamAV detection and ML classifier strongly indicate malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://beyondbeliefthebook.com/uploads/1/3/0/7/130738989/lomukir.pdf
    • http://bisconsulting.it/uploads/1/3/0/5/130588712/f458353970134c0.pdf
    • http://porschasdivinediamonds.com/uploads/1/3/0/5/130550997/nizumozobuwatod_pixefisadebez_negiraza.pdf
    • http://thenintendoclubpodcast.com/uploads/1/3/0/4/130483109/692b4.pdf
    • http://lollye.com/uploads/1/3/0/5/130551325/dewasineri-jesopigos-xaloxemi.pdf
    • http://worldbankawards.com/uploads/1/3/0/6/130604315/94b291cfe1b9b0.pdf
    • http://ameliaquilts.com/uploads/1/3/0/4/130483550/aeaa7080d21.pdf
    • http://phillydish.net/uploads/1/3/0/2/130289161/1742682.pdf
    • http://millsupportzuid.com/uploads/1/3/0/5/130543813/4297084.pdf
    • http://michelleislivingwell.com/uploads/1/3/0/7/130739535/wuwanuxekodubi.pdf
    • http://missusvicarious.com/uploads/1/3/0/6/130604109/tikav_fevaden_rerimu.pdf
    • http://theelfbox.com/uploads/1/3/0/2/130291592/130291592.html#how+to+find+the+total+surface+area+of+a+rectangular+prism+net

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001336.bin
b546867ea6f12c2d7d4c71d99a22669aae352f5a95551ed8c5f3f70b7243b43d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1336 8000 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.