Malicious PDF — malware analysis report

Static analysis result for SHA-256 161ce72903ed39cd…

MALICIOUS

PDF

38.6 KB Authoring application: SWFTools
MD5: 9a639599d29384b71ba6b6ce0002c6cf SHA-1: ab8c06aa0532891d42ae10872b461217ee2116df SHA-256: 161ce72903ed39cd922d0089e734141501aeae9e5f7eb6d2968b340a19448943
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file contains a large number of embedded links to external PDF files hosted on various domains. This behavior is indicative of a link farm or a mechanism to distribute further malicious content or manipulate search engine results. The ClamAV detection and ML classifier strongly suggest malicious intent, likely related to phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://voodooshopbtown.com/uploads/1/3/0/8/130813612/titidu_kojof_rosepite.pdf
    • http://thomastrevethan.com/uploads/1/3/0/3/130379291/dujawel-nafutoge-wutajewan.pdf
    • http://wellsscience8.com/uploads/1/3/0/2/130270811/e03872a4d191370.pdf
    • http://www.kamufisaproperty.com/uploads/1/3/0/7/130740013/duvajilivederer_xobafixed.pdf
    • http://brassim.com/uploads/1/3/0/5/130539798/tizixufogogu-temoxa-kevonaredu.pdf
    • http://joinhomesmartnow.com/uploads/1/3/0/4/130488759/3075892.pdf
    • http://www.fortwaynetreeoflifeplacenta.com/uploads/1/3/0/6/130620393/9909269.pdf
    • http://themindfulchristian.net/uploads/1/3/0/6/130604886/vusewebet.pdf
    • http://diebeziehungsshow.de/uploads/1/3/0/3/130323594/nezimujefoz.pdf
    • http://321markets.com/uploads/1/3/0/5/130550736/jopeme.pdf
    • http://accidentalmuse.com/uploads/1/3/0/6/130604202/70c513.pdf
    • http://cohenandriley.com/uploads/1/3/0/6/130622012/7452243.pdf
    • http://plantcityhomesforsale.net/uploads/1/3/0/2/130270985/nuwisul.pdf
    • http://adsl-63-204-18-47.benefitplans.org/uploads/1/3/0/4/130488530/130488530.html#twilight+bella%27s+song+piano+sheet+music

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003b53.bin
f87da5d203fe7824bb90bdd8d91efdc63e8ee0aaab15765948ee87a01b7bb251		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3B53 9608 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.