Malicious PDF — malware analysis report

Static analysis result for SHA-256 293d8df0ae9499f7…

MALICIOUS

PDF

48.7 KB Authoring application: pstoedit
MD5: ce224843d2d3644cdbb6a86e24a5ecdb SHA-1: 15dc036e66c01d390e8fa920c592a1464c4c3b99 SHA-256: 293d8df0ae9499f7af0ccf6765acb89d0c289a37d977d885f68feecd9490d844
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious File

The PDF file contains a large number of embedded links to external PDF files hosted on various domains. This behavior is indicative of a link farm or a distribution mechanism for malicious content, as suggested by the ClamAV detection and ML classifier. The primary purpose appears to be directing users to these external resources, which are likely malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://comfortablechristianity.com/uploads/1/3/0/6/130639860/kutovomatasepaxefo.pdf
    • http://deannagrant.com/uploads/1/3/0/3/130323185/3aead405.pdf
    • http://no-drift.com/uploads/1/3/0/4/130488096/3ff2514b330aab3.pdf
    • http://astoryofsplendor.com/uploads/1/3/0/6/130640198/429f379.pdf
    • http://houseofsteezy.net/uploads/1/3/0/2/130271232/8640575.pdf
    • http://robyntapleyjewelry.com/uploads/1/3/0/5/130551949/9231167.pdf
    • http://userfriendlyfaith.com/uploads/1/3/0/5/130550772/dotixoperubevekitire.pdf
    • http://negsbestthing.com/uploads/1/3/0/5/130589121/9247135.pdf
    • http://recordingstudiospokane.com/uploads/1/3/0/5/130590462/maseruvewelir.pdf
    • http://mitco-solutions.com/uploads/1/3/0/3/130313284/nasanuka.pdf
    • http://beyondhillco.com/uploads/1/3/0/5/130539871/130539871.html#simplest+definition+of+welfare+economics

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001287.bin
bd3af3b30bab235dad0a87c8e652b2f3e027bcd81cbddd824dd95354ac3e63e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1287 8740 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.