Malicious PDF — malware analysis report

Static analysis result for SHA-256 3797354c49f7a74e…

MALICIOUS

PDF

81.9 KB Authoring application: ImageMagick
MD5: 1ca41c1037f54e599467ca566efb731a SHA-1: 815bdbb805e49f0a6f6586396e6981f47bf201c7 SHA-256: 3797354c49f7a74e90536002240d99e4a9d763066a63be5b560c7f596b95fc3d
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of external links, a technique commonly used in SEO poisoning and phishing campaigns to redirect users to malicious sites. The ClamAV detection and ML classifier strongly indicate malicious intent. The embedded URLs suggest a link farm designed to distribute further malicious content or phish for information.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://drsba.org/uploads/1/3/0/6/130621574/kodujonivolin.pdf
    • http://thinkupdate.com/uploads/1/3/0/4/130436154/ribigetalepiwe.pdf
    • http://sousmarine.de/uploads/1/3/0/3/130323251/divexebamelomo_lugek.pdf
    • http://carretillasbarcelona.net/uploads/1/3/0/5/130545816/2243284.pdf
    • http://tasteparty.jpjsweets.com/uploads/1/3/0/8/130814666/663ec47cbfe.pdf
    • http://readthinkwritespeak.com/uploads/1/3/0/7/130738997/1026105.pdf
    • http://saint-malo-agence-immobiliere-cabinetmoraine.com/uploads/1/3/0/6/130620321/tuxefuvutabeku_fuvifukofovapaz.pdf
    • http://prolinelifepharmaceutical.com/uploads/1/3/0/6/130621031/5400172.pdf
    • http://www.ship-of-theseus.org/uploads/1/3/0/8/130814401/6228662.pdf
    • http://kaukauproductions.com/uploads/1/3/0/4/130476273/a5b65763b1.pdf
    • http://fuckingprogress.com/uploads/1/3/0/7/130775573/1045554.pdf
    • http://myssample.com/uploads/1/3/0/5/130539428/7226815.pdf
    • http://penguinpants.com/uploads/1/3/0/6/130603847/cd7fc976.pdf
    • http://mydhfastmandat.com/uploads/1/3/0/2/130272600/ruwalajiva.pdf
    • http://ladyboner.net/uploads/1/3/0/5/130550949/baf43f.pdf
    • http://host95.carmichaelnl.com/uploads/1/3/0/6/130603917/130603917.html#old+seven+wonders+of+the+world+in+hindi

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000a76e.bin
1723f1ced37cc89d69e30f3df6281c5e5fb8989544fd4587aa75b00c91af2fd0		 pdf-font-stream PDF embedded font (sfnt) at offset 0xA76E 1388 bytes
font_01_sfnt_off0000b27f.bin
d110cf698686b74c69cedcb09a40aa3da45639cd3aee7219be56d52a16ae86b0		 pdf-font-stream PDF embedded font (sfnt) at offset 0xB27F 20820 bytes
font_02_sfnt_off0000e9bb.bin
34ef282a7b5b5b6ced3dfd2cb4ce8d53bb6ce42d38e27695f2f2ffde27fb568a		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE9BB 7468 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.