Malicious PDF — malware analysis report

Static analysis result for SHA-256 16207698efe3ed8a…

MALICIOUS

PDF

39.6 KB Authoring application: Smallpdf Desktop
MD5: c4747e0046e84151f14caa90112d8900 SHA-1: 7b471717b5c4d77f088ee35eea673b0a2d3841e8 SHA-256: 16207698efe3ed8a8fa65745c37418b12d2859641d4ee2bc67ca9be593424111
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains a large number of embedded external links, identified as a link farm, which is a common technique for SEO poisoning and directing users to malicious sites. ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports its malicious nature. The ML classifier also strongly indicated maliciousness. No scripts were extracted, but the extensive link farm suggests a phishing or traffic-driving campaign.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://litecoinrealestate.com/uploads/1/3/0/5/130551294/bf9525505d3b.pdf
    • http://artthouholy.com/uploads/1/3/0/6/130621441/tinagebubajeve.pdf
    • http://bru2u.com/uploads/1/3/0/6/130604355/jesudal.pdf
    • http://nowpixapp.com/uploads/1/3/0/6/130604879/wimewimijedemigite.pdf
    • http://www.stamenandpistil.net/uploads/1/3/0/5/130552084/3889473.pdf
    • http://www.chemistrybybatz.com/uploads/1/3/0/4/130478566/a8bbd2e.pdf
    • http://www.oilbossacademy.com/uploads/1/3/0/6/130640047/pazamoravifi.pdf
    • http://catapult42.com/uploads/1/3/0/2/130289779/6771604.pdf
    • http://www.theselffullfillingprophet.com/uploads/1/3/0/4/130483801/3088069.pdf
    • http://morgancycle.ca/uploads/1/3/0/5/130550981/wijilo.pdf
    • http://aquasunenergy.com.au/uploads/1/3/0/6/130620937/fivawebuz.pdf
    • http://petsitteratlarge.com/uploads/1/3/0/7/130775461/repab_banesubudagosun_titisuvitas.pdf
    • http://pinellasperipheralneuropathy.com/uploads/1/3/0/4/130483973/jaredinop-boron.pdf
    • http://www.outon4th.com/uploads/1/3/0/6/130603760/a42012.pdf
    • http://mahmoudawad.net/uploads/1/3/0/7/130740149/zizavafuwurobedipa.pdf
    • http://nataliahermida.com/uploads/1/3/0/5/130540155/7015499.pdf
    • http://smilyface.org/uploads/1/3/0/5/130546923/fe4253f0805.pdf
    • http://www.ocontocountyjailoutreach.com/uploads/1/3/0/4/130435872/fd14145.pdf
    • http://usatfregistration.com/uploads/1/3/0/5/130589373/rezokunesixu.pdf
    • http://vps18.pleasingfood.com/uploads/1/3/1/0/131070096/131070096.html#undrip+canada+bill+262

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003b9f.bin
3107446ed7c91956509cea6e7331f9ef6b537775d768f3cd2ab110f37fa8d5c0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3B9F 8244 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.