Malicious PDF — malware analysis report

Static analysis result for SHA-256 32652308685aaa0e…

MALICIOUS

PDF

42.2 KB Authoring application: Pdftk
MD5: 30fea18d638f8d4ba701acca10fbc90b SHA-1: 4fe96649f3c540ca4d960471f35818c58d0e33f7 SHA-256: 32652308685aaa0ef01e36a53e21cb03681232f39b523dce487d80ef3640b653
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded links to external PDF files hosted on various domains, indicating a link farm or redirection strategy. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the ML classifier output strongly suggest malicious intent, likely phishing or malware distribution. The document body's mention of 'Blighted ovum miscarriage' appears to be a lure to disguise the malicious nature of the links.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://shadowbendtest6.com/uploads/1/3/0/7/130740000/duvujexilid_tavatifi_lavevureke_jezojutokoke.pdf
    • http://centralrefrigerationinc.us/uploads/1/3/0/6/130620997/041ae1278.pdf
    • http://mh-aero.de/uploads/1/3/0/2/130291029/sinojotitowir.pdf
    • http://davewalcott.com/uploads/1/3/0/3/130323632/904566.pdf
    • http://audio-start12.icu/uploads/2020/01/28/6545770.pdf
    • http://veb.shopprime.ru/uploads/2020/01/28/7174277.pdf
    • http://odempsey.net/uploads/1/3/0/5/130543050/xevexufivodov_bososovuf_zekadudizawaku.pdf
    • http://vero.heartplayers.com/uploads/2020/01/29/4852250.pdf
    • http://proarbtreeservices.com.au/uploads/1/3/0/5/130546385/juvevesutetaxudas.pdf
    • http://sweetestdreams.org/uploads/1/3/0/2/130288406/130288406.html#blighted+ovum+miscarriage+at+12+weeks

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000124b.bin
b4814c4295799f2532c1894b6954e10adfc171a96462db74fbad58fb104270ff		 pdf-font-stream PDF embedded font (sfnt) at offset 0x124B 8260 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.