Malicious PDF — malware analysis report

Static analysis result for SHA-256 18155cdd3b176fb3…

MALICIOUS

PDF

46.8 KB Authoring application: Solid Converter PDF
MD5: 6f0b532e88ec2510e6eda2f3dddc3b36 SHA-1: 820b6d085020f0ad02d56ef91ff732d9c13eedc4 SHA-256: 18155cdd3b176fb34d8f7c309fe08567b7cdf9f24c0fb3d89be07ce16f13ef18
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded external links, a technique commonly used for SEO poisoning or phishing campaigns. The ClamAV detection and ML classifier strongly indicate malicious intent. The embedded URLs are likely part of a link farm designed to redirect users to malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://bellevueboysswive.com/uploads/1/3/0/5/130551745/487484.pdf
    • http://www.gigispastrycafe.com/uploads/1/3/0/4/130478520/xowotujane_dofonisetogixoz.pdf
    • http://autocambo.com/uploads/1/3/0/5/130546076/5677872.pdf
    • http://hostmaster.yogajosie.co.uk/uploads/1/3/0/3/130323424/5669b27a61473d.pdf
    • http://norvelfinancialsolutions.com/uploads/1/3/0/6/130621279/lilowufibijixurositu.pdf
    • http://www.zembatackle.com/uploads/1/3/0/5/130589243/pojawon_topadifizu.pdf
    • http://askarando.com/uploads/1/3/0/6/130639277/164132.pdf
    • http://mrlapta.com/uploads/1/3/0/2/130271111/bewubaxexodositugifo.pdf
    • http://hostgroningen.com/uploads/1/3/0/5/130550703/donuvodidulewob.pdf
    • http://mycharlottedoulas.com/uploads/1/3/0/7/130775841/e4a55ca39cb15.pdf
    • http://dpapernow.com/uploads/1/3/0/4/130483753/totesenegubiwusit.pdf
    • http://earthsoffspring.com/uploads/1/3/0/6/130604255/ec59d4277ed.pdf
    • http://hendersonsboysgame.com/uploads/1/3/0/6/130621281/5610982.pdf
    • http://acorymaloy.com/uploads/1/3/0/7/130740530/2285433.pdf
    • http://biapuestadelsol.com/uploads/1/3/0/9/130969614/kasiro_pedisisebop_kopatijudala.pdf
    • http://integralwellness.com.au/uploads/1/3/0/7/130775111/5dc242b3f1.pdf
    • http://circumchange.ca/uploads/1/3/0/2/130288465/fuvowexa.pdf
    • http://brundlethwaite.com/uploads/1/3/0/7/130739346/8856223.pdf
    • http://leopoldomarino.com/uploads/1/3/0/6/130621244/jusadisebu.pdf
    • http://www.nashsveggies.com/uploads/1/3/0/5/130551809/4e7cee274a4574b.pdf
    • http://dreamfarmeracademy.com/uploads/1/3/0/4/130483939/2194819.pdf
    • http://vsemdaryu.site/uploads/1/3/0/5/130590177/f7f4c1e55215.pdf
    • http://foggery.com/uploads/1/3/0/5/130588501/7949144.pdf
    • http://rideandtrain.com/uploads/1/3/0/5/130551745/zojopizemi.pdf
    • http://www.investnurself.com/uploads/1/3/0/7/130739693/460446.pdf
    • http://7ddyg.slpny.com/uploads/1/3/0/3/130379248/130379248.html#baritone+ukulele+tuning+app
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License
    • https://fedoraproject.org/wiki/Licensing/LiberationFontLicense

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000033e7.bin
779aa567746046747dac965df7fdfb06ff632674a0a99ce247a327bf89f0fa63		 pdf-font-stream PDF embedded font (sfnt) at offset 0x33E7 16036 bytes
font_01_sfnt_off000047fe.bin
63f5e27ee3d24cc00d413e59c301cc73ab377383609796993547673f2bea898c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x47FE 2600 bytes
font_02_sfnt_off0000536f.bin
0288213b8dc22f4a230eb9217404f22ca34c80e264c596613487943ae3545f39		 pdf-font-stream PDF embedded font (sfnt) at offset 0x536F 7552 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.