Malicious PDF — malware analysis report

Static analysis result for SHA-256 161636cb65e0c7c9…

MALICIOUS

PDF

71.1 KB Authoring application: Nitro PDF
MD5: ef1b94f71bd94a92a71bc48d142d4545 SHA-1: 81565cce6656abb3eeb78001878346c7c74f4c7b SHA-256: 161636cb65e0c7c95c0e648ea5ea8d9da5526c390667eb3d0b278b02de2fed3c
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file contains a large number of embedded URLs pointing to external PDF files, as indicated by the PDF_SEO_LINK_FARM heuristic. This suggests a tactic to manipulate search engine results or distribute additional malicious content. The ML classifier and ClamAV detection strongly support its malicious nature, classifying it as phishing-related.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://derekrecks.com/uploads/1/3/0/5/130547728/4ec4c5.pdf
    • http://papomundo.org/uploads/1/3/0/6/130620789/zazufaze_sovetajitudevuw_fiwujuxatebadi_zodanowo.pdf
    • http://www.tiremfood.com/uploads/1/3/0/5/130550931/d24ffb1.pdf
    • http://soundsofmars.com/uploads/1/3/0/5/130542985/1538685.pdf
    • http://cncprocedures.com/uploads/1/3/0/4/130436473/470d5109a.pdf
    • http://theblockhousecafe.com/uploads/1/3/0/5/130550961/serefepulexuluxulaw.pdf
    • http://occupassion.co/uploads/1/3/0/2/130289583/gakogesexozubimazoze.pdf
    • http://dengyulan.com/uploads/1/3/0/6/130640231/8201555.pdf
    • http://thecellardistrict.com/uploads/1/3/0/3/130379523/pusovamumasexudod.pdf
    • http://michaelpetersenphotography.com/uploads/1/3/0/6/130639042/kenaka-zazilazara-funog.pdf
    • http://michalrutkowski.net/uploads/1/3/0/5/130550756/zovojazajaketijevoz.pdf
    • http://newlifefitz.org/uploads/1/3/0/6/130603832/gotago.pdf
    • http://www.localgreenchoice.com/uploads/1/3/0/6/130639914/jojoliviwalekoposik.pdf
    • http://redguitarproductions.net/uploads/1/3/0/5/130551054/nuxenikiwun.pdf
    • http://mysticmancreations.com/uploads/1/3/0/4/130488399/fezusivelej_riribe_dodem_wagevodawawo.pdf
    • http://pupplesapp.com/uploads/1/3/0/2/130288506/kusosavubidijuzez.pdf
    • http://sta-66-99-58-221.ladse.org/uploads/1/3/0/5/130545573/130545573.html#ap+polytechnic+lecturers+exam+date+2019+freejobalert

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003b87.bin
ebeedd6f2d7341e22bc2fde0b76dcfb2ca1c3678118bf8d16985d1a009e280d9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3B87 7916 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.