Malicious PDF — malware analysis report

Static analysis result for SHA-256 2a6aa038a7fa3d6f…

MALICIOUS

PDF

36.4 KB Authoring application: pstoedit
MD5: 191385115029cdefbe6b848fcd1b6031 SHA-1: 90c86ab05eb7a9a4d9efd7fdd3b278755e600e8c SHA-256: 2a6aa038a7fa3d6f8fb5414c6b16113b49735a284c5e3e3ef14f102ae955d9b1
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF file contains a large number of external links to other PDF files, a technique often used for SEO poisoning or to redirect users to malicious content. The ClamAV detection and ML classifier strongly indicate maliciousness. The embedded URLs are likely part of a phishing or malware distribution scheme, disguised as a document related to share transfers.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://nathaniel-gaynor.com/uploads/1/3/0/2/130287536/sawezowemiviper.pdf
    • http://catchingpips.net/uploads/1/3/0/5/130590355/0743c5909fb15d.pdf
    • http://eefkeduin.nl/uploads/1/3/0/5/130551226/1489150.pdf
    • http://camidogtraining.com/uploads/1/3/0/6/130639712/wekagekut.pdf
    • http://brianhaggard.com/uploads/1/3/0/2/130291635/getamovezamadaziwijo.pdf
    • https://vuxejatisi.weebly.com/uploads/1/3/0/4/130483860/68c68401080e8.pdf
    • http://mariageronimo.com/uploads/1/3/0/6/130639215/39cf3bdc74e0.pdf
    • http://blockchainambassador.ca/uploads/1/3/0/3/130323163/130323163.html#covering+letter+format+for+share+transfer

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001137.bin
69770e05e9657c52e24c1c993882e0031d049890be699d4eeca9d798ec45e37f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1137 7900 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.