Malicious PDF — malware analysis report

Static analysis result for SHA-256 2484389b1ae0d5d7…

MALICIOUS

PDF

40.4 KB Authoring application: Solid Converter PDF
MD5: abf8d94c83edd05e78a742ae5e02cda0 SHA-1: a918783cf211df355dc4a5d28a0156b5385096a6 SHA-256: 2484389b1ae0d5d70347e1493dca29eba13bd280fd5b513aa4046cbe5c753988
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of external links, a technique often used for SEO poisoning or to redirect users to malicious sites. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the ML classifier strongly indicate malicious intent. The embedded links are likely part of a phishing or malware distribution scheme.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://beasleycounselingservices.com/uploads/1/3/0/5/130551971/sanob_gufisa_medixigelus.pdf
    • https://wovitazepi.weebly.com/uploads/1/3/0/5/130543538/wiwafirop.pdf
    • http://bestmassagescottsdale.com/uploads/1/3/0/5/130588779/27c68bf7ee90bd.pdf
    • http://surfergirl.us/uploads/1/3/0/7/130740598/nabefuperopokogovali.pdf
    • http://samokut.0106shop02.fun/uploads/2020/01/28/bowiloritur.pdf
    • http://anderson-hammond.com/uploads/1/3/0/4/130476004/65b7c34bf637.pdf
    • https://zebonudukeme.weebly.com/uploads/1/3/0/4/130436521/0eafe6c2.pdf
    • http://xldylcgwhynglsbia.weebly.com/uploads/1/3/0/4/130435738/9866161.pdf
    • http://bestflooringco.com/uploads/1/3/0/6/130604241/4898578.pdf
    • http://securevisionmediasolutions.com/uploads/1/3/0/4/130491852/130491852.html#postpartum+ab+workout+diastasis+recti

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000126a.bin
12a2884b362de8976355f8a8d3eef82c8f929eb2a277a5674930d3778d9f4ef3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x126A 8540 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.