Malicious PDF — malware analysis report

Static analysis result for SHA-256 19c1594261f9714d…

MALICIOUS

PDF

35.0 KB Authoring application: Nitro PDF
MD5: f30ee3935c791b2ede10a1618bf37001 SHA-1: a01b06f0869d3e787dbf1ae35ccae08f60491025 SHA-256: 19c1594261f9714d9f235ff09d4daff2d7a18d8d50c158068ab9204aca3cf0a9
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1566.002 Spearphishing Link

The PDF file contains a large number of embedded external links, as indicated by the PDF_SEO_LINK_FARM heuristic. These links point to numerous PDF files hosted on various domains, suggesting a link farm or a phishing campaign. The ClamAV detection and ML classifier further support the malicious nature of this file. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://mothersfx.com/uploads/1/3/0/4/130483118/6901234.pdf
    • http://doctorberrycounseling.com/uploads/1/3/0/7/130775756/5314936.pdf
    • http://www.joycedarren.com/uploads/1/3/0/6/130603772/vugusolebivu.pdf
    • http://soullinks.org/uploads/1/3/0/2/130270958/sizozivelapidaxax.pdf
    • http://presidio.me/uploads/1/3/0/5/130588542/2f2b1236d5f86.pdf
    • http://mikealfieri.net/uploads/1/3/0/6/130621713/xoxitozevubojox_fosafus_gawenaxiluxa.pdf
    • http://tripbuys.com/uploads/1/3/0/8/130813732/lexutu_dabuvafuxo_xozom_tivedoxuxesoka.pdf
    • http://usecondomsensesyracuse.com/uploads/1/3/0/6/130640066/38894b3d.pdf
    • http://norcalpomskies.com/uploads/1/3/0/8/130815228/2763281.pdf
    • http://bellamayphotography.com/uploads/1/3/0/7/130776594/pejaxukovagosa-panet.pdf
    • http://naturalbalancetherapies.org/uploads/1/3/0/8/130813913/suxupovasarud.pdf
    • http://myalliedbenefits.com/uploads/1/3/0/2/130291416/nefimurokarudebalo.pdf
    • http://valleycreekcustomdesigns.com/uploads/1/3/0/2/130273803/fuduja.pdf
    • http://warrenservicesclub.com.au/uploads/1/3/0/5/130539042/73b071c4c12fe.pdf
    • http://wehappyhair.com/uploads/1/3/0/6/130603855/130603855.html#task+1+process+chart+for+practice

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002fc9.bin
e1e27172d13bd2c2d35983a567f6517ec5f55ddf8e06a8fbc7113d0eb2a05030		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2FC9 7540 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.