Malicious PDF — malware analysis report

Static analysis result for SHA-256 1c24b3c8825d3b20…

MALICIOUS

PDF

41.1 KB Authoring application: PDF Studio
MD5: cdc7049291eb9648389a41c5dace1977 SHA-1: a5cdeeccc6d845e76de7c625665b7f406e58af4f SHA-256: 1c24b3c8825d3b20b72f2175435601e78187f34473859a7c1e8499c5ebe158c5
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded URLs pointing to other PDF files, indicating a link farm or distribution mechanism. The ClamAV detection and ML classifier strongly suggest malicious intent, specifically identified as phishing or a robot installer. No scripts were extracted, but the sheer volume of external links suggests a coordinated effort to redirect users, likely to phishing sites or to download further malware.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://qacloud2.com/uploads/1/3/0/5/130551809/7627777.pdf
    • http://wheelrepairfortworth.com/uploads/1/3/0/4/130483638/vupenuwivozorevob.pdf
    • http://callandputoptions.net/uploads/1/3/0/5/130539728/3975573.pdf
    • http://mymobilenotarypublic.com/uploads/1/3/0/7/130776042/zolobakatimax-fazabavipekade-genesowuve.pdf
    • http://christianfemininity.org/uploads/1/3/0/6/130620265/ef09af6b8929a6.pdf
    • http://www.giamarshello.com/uploads/1/3/0/3/130379612/4706547.pdf
    • http://giniac.fr/uploads/1/3/0/7/130740371/xuviwovuriza.pdf
    • http://nononsensehomeinspection.com/uploads/1/3/0/4/130436252/rixakapowajolazotox.pdf
    • http://ballantynesaferide.com/uploads/1/3/0/4/130483980/2789b82ad2624.pdf
    • http://douglaspharmachems.com/uploads/1/3/0/8/130874141/3fb253fb349e4.pdf
    • http://nurseryrhymedesign.com/uploads/1/3/0/6/130620985/e3b457.pdf
    • http://mixforteachers.com/uploads/1/3/0/6/130639554/wovijateboz.pdf
    • http://mobilizeonline.com/uploads/1/3/0/5/130588676/kalevojaligeto_rofipuwinawat.pdf
    • http://seesickapp.com/uploads/1/3/0/2/130270785/lupawutu.pdf
    • http://midlu.net/uploads/1/3/0/4/130483118/sekikotu.pdf
    • http://myjessiereyez.com/uploads/1/3/0/5/130550754/tuwuzikirabig-sekuvunob-nuxegetopega-fabisuvurapule.pdf
    • http://www.stout-mechanical-ok.com/uploads/1/3/0/4/130488736/mogativozabevo.pdf
    • http://doodlepadart.com/uploads/1/3/0/3/130323401/6842283.pdf
    • http://citywidevalet.com/uploads/1/3/0/7/130739978/debiweb.pdf
    • http://anywheredogtraining.com/uploads/1/3/0/7/130739705/rokesavun.pdf
    • http://raleighoffice.net/uploads/1/3/0/6/130639038/8c2c50fc88.pdf
    • http://coachrenee2u.com/uploads/1/3/0/5/130542953/pojefukamota.pdf
    • http://cockherodudes.com/uploads/1/3/0/7/130776126/bukubemido.pdf
    • http://www.b2bbookkeepers.com.au/uploads/1/3/0/6/130621125/wokoxux-fanixupi-virog.pdf
    • http://host126.carmichaelnl.com/uploads/1/3/0/8/130873818/130873818.html#gastric+sleeve+diet+after+op

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003d0b.bin
37c9a73702f2d6027fcc4375b5ffc50aea1422c0fcd21c95bc2203d757059ade		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3D0B 7952 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.