Malicious PDF — malware analysis report

Static analysis result for SHA-256 30e3d9b0f459a524…

MALICIOUS

PDF

49.3 KB Authoring application: pstoedit
MD5: 0096f10b149481e0a34bb70b0805066b SHA-1: 4451d29e15ade27bc417cd1f82b54525a7ec8885 SHA-256: 30e3d9b0f459a524ebc2dd8400b61d4d9e99ef9f628165136553d7b200b86ddd
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic, which is indicative of a phishing or redirection campaign. The embedded URLs are presented as resume templates, a common lure for users seeking employment. The ML classifier and ClamAV detection strongly support the malicious nature of this file, classifying it as phishing malware.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://nuts4less.net/uploads/1/3/0/5/130550690/9efb8.pdf
    • http://jamesorourkelaw.com/uploads/1/3/0/6/130604551/3900713.pdf
    • http://discoveryresourcesllc.net/uploads/1/3/0/6/130620956/9ad4ae3843985.pdf
    • http://nyspace.org/uploads/1/3/0/4/130476068/4861809.pdf
    • http://newtribes.org/uploads/1/3/0/4/130436196/9173143.pdf
    • http://mh-aero.de/uploads/1/3/0/2/130270993/5ee4ef0.pdf
    • http://wojude.dtrservice.it/uploads/2020/01/29/kanobedijararodi.pdf
    • http://nationalfootballcheerleadersalumni.org/uploads/1/3/0/2/130291646/130291646.html#free+download+template+resume

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001114.bin
b9b20b2eff846edfabc3af52721261b9513e02c15bdfe65a566363adbf856db4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1114 8220 bytes
font_01_sfnt_off000075a3.bin
062abeeb0630068c9ebda4cd69880ba7d22c023ef851e82e77d1a768bfa0705b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x75A3 17648 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.