Malicious PDF — malware analysis report

Static analysis result for SHA-256 0e7c846677724f52…

MALICIOUS

PDF

35.1 KB Authoring application: Solid Converter PDF
MD5: 28718ecdb64b6599bbf8994f688ec645 SHA-1: 84306bf529c1a97a49b3d59af3889f75846be007 SHA-256: 0e7c846677724f52c21a9b064d6ead4e710c85bd2a97222e590c013f4c2a52cc
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains a large number of embedded external links, identified as a link farm. This behavior, combined with ClamAV detection as Pdf.Phishing.TtraffRobotInstall-7605656-0 and a high ML classifier score, strongly suggests a malicious intent, likely for SEO spam or phishing. The embedded links are the primary indicators of compromise.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://kevinmellobook.com/uploads/1/3/0/2/130272432/kosox.pdf
    • http://rfeistart.ru/uploads/2020/01/29/b6691aab.pdf
    • http://the-goodnesskitchen.com/uploads/1/3/0/6/130604807/251fad5b4.pdf
    • http://listen2alexza.com/uploads/1/3/0/6/130621800/basolirujajujunu.pdf
    • http://cuppagusto.com/uploads/1/3/0/3/130323390/vavaximenuvaz.pdf
    • http://nstarlight.com/uploads/1/3/0/6/130604502/patafisov_nelutizilamix_xogusit_zamorewe.pdf
    • http://msgray.org/uploads/1/3/0/2/130272385/5063183.pdf
    • http://swimpersonal.com/uploads/1/3/0/2/130272918/kuvuwuzesidupefoweko.pdf
    • http://wickedladiesbees.com/uploads/1/3/0/5/130543467/xeripileposekoz.pdf
    • http://quillesthon.com/uploads/1/3/0/4/130483631/padezeta.pdf
    • http://sita.fotomag.ru/uploads/2020/01/27/8912222.pdf
    • http://atlantapermaculture.com/uploads/1/3/0/5/130546885/lenaxude-malutirowelu-lulezuberu.pdf
    • http://hausparzival.org/uploads/1/3/0/2/130289595/vebufijupajipa.pdf
    • http://softparsavasoft144.weebly.com/uploads/1/3/0/4/130435659/802957.pdf
    • http://orangepeelyoga.com/uploads/1/3/0/6/130620822/c710c35a1.pdf
    • https://bomarumanepa.weebly.com/uploads/1/3/0/6/130604420/pofoduxebofuzazalowa.pdf
    • http://boldbelize.com/uploads/1/3/0/6/130604428/166645.pdf
    • http://nupijugo.fatedifiore.ru/uploads/2020/01/27/b3b0e62234.pdf
    • http://audiostart32.icu/uploads/2020/01/27/tobavuvurolaza-zukanuf-jeziwidosejopav-sepewefuxevi.pdf
    • http://ndchair.com/uploads/1/3/0/3/130379959/130379959.html#research+advances+in+dry+anaerobic+digestion+process+of+solid+organic+wastes

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000015ee.bin
443a2e00eefa8370fe22ab5d8bfc3693638d8a1b0aefd7b0be921bb39ff41ccc		 pdf-font-stream PDF embedded font (sfnt) at offset 0x15EE 7844 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.