Malicious PDF — malware analysis report

Static analysis result for SHA-256 17c922c21ccb549b…

MALICIOUS

PDF

42.2 KB Authoring application: PDFedit
MD5: 8c287238b40da7f84f10939856f3981f SHA-1: e80493b4588f30ce9423ae61416388718deb934e SHA-256: 17c922c21ccb549b282148eb20ee98a74d3984c0e518fea2bbad67c3256285f9
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded URLs pointing to external PDF files, a technique often used for SEO spam or to distribute further malicious content. The ClamAV detection and ML classifier strongly indicate malicious intent. While no scripts were extracted, the heuristic 'PDF_SEO_LINK_FARM' and the sheer volume of external links suggest a coordinated effort to manipulate search results or redirect users to potentially harmful sites.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://elitesip.com/uploads/1/3/0/3/130323789/3925492.pdf
    • http://desatascosmontcadaireixac.com/uploads/1/3/0/2/130289778/wodupafozis.pdf
    • http://rachelskaufman.com/uploads/1/3/0/5/130550830/13bb7727.pdf
    • http://dirtysoles305.com/uploads/1/3/0/4/130483836/tuvebejero.pdf
    • http://developertony.com/uploads/1/3/0/7/130775845/b09cfdef202.pdf
    • http://callanjames.co.nz/uploads/1/3/0/3/130323599/5846701.pdf
    • http://ludditetechnologies.net/uploads/1/3/0/4/130476006/farupune-zibis-wapurifutowo-faxazesusutosop.pdf
    • http://kenplattlaw.net/uploads/1/3/0/5/130539437/nakubum_tadezizep_nubevupete.pdf
    • http://fitfabulousandoverforty.com/uploads/1/3/0/5/130541462/6abeca.pdf
    • http://www.thesaint.world/uploads/1/3/0/8/130815026/vutujetapu.pdf
    • http://valence.media/uploads/1/3/0/6/130621060/pirubomu.pdf
    • http://www.pittsburghsepticcleaner.com/uploads/1/3/0/8/130874514/xiwotazikav.pdf
    • http://nashandcothreads.com/uploads/1/3/0/6/130621998/185595.pdf
    • http://atlkickball.com/uploads/1/3/0/4/130476462/buvajubusuz.pdf
    • http://windsorwes.com/uploads/1/3/0/4/130488195/paletaxav.pdf
    • http://www.vorosclassroom.com/uploads/1/3/0/3/130323493/zarulaneveluj_vewovidavak.pdf
    • http://cetlgroup.org/uploads/1/3/0/5/130551058/3168123.pdf
    • http://snackstore.biz/uploads/1/3/0/8/130874501/b9e2427ce1d75.pdf
    • http://emilykasra.com/uploads/1/3/0/8/130873975/lojil-netaxuravela-lijega.pdf
    • http://electro-haptics.com/uploads/1/3/0/7/130739528/wazolapi.pdf
    • http://sta-66-99-58-194.ladse.org/uploads/1/3/0/7/130776054/130776054.html#x-force+keygen+for+all+autodesk+2020

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004469.bin
76117ec449c30ef9b10fbb90046365b7bfc5aeadb983eb0d42bfd91907fb00f7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4469 8456 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.