Malicious PDF — malware analysis report

Static analysis result for SHA-256 3b1eab450082d573…

MALICIOUS

PDF

44.5 KB Authoring application: Adobe PDF Library 9.0
MD5: 0ae1c5f860906a2e5fec989d2ce26cf0 SHA-1: a88ac5a1b98443e2e5ce7559bf784c0a036728c3 SHA-256: 3b1eab450082d5739ffccb549a60a0465e4d56c1558d59f5d74025615c8610cf
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded links to external PDF documents, a technique often used for SEO manipulation or to distribute further malicious content. The ClamAV detection and ML classifier strongly indicate malicious intent. The primary attack pattern involves directing users to a network of linked PDFs hosted across multiple domains.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://holypost.info/uploads/1/3/0/6/130640022/defekevupup.pdf
    • http://ohrsaadya.net/uploads/1/3/0/4/130435947/6780530.pdf
    • http://aliasafawrites.com/uploads/1/3/0/7/130738704/vorotebipokufubiwabi.pdf
    • http://believeitornotphotography.com/uploads/1/3/0/7/130740598/2196236.pdf
    • http://bubblebag-australia.net/uploads/1/3/0/4/130476148/wofaf_pirafatebeketew.pdf
    • http://imgbasic.com/uploads/1/3/0/5/130543087/jizozowogitemawu.pdf
    • http://sportscomplexlv.com/uploads/1/3/0/6/130621351/21922.pdf
    • http://thisisgood.org/uploads/1/3/0/4/130488243/3762d24.pdf
    • http://cityofkawarthalakesrealty.ca/uploads/1/3/0/4/130490301/ribenekew.pdf
    • http://rockymountainracquet.com/uploads/1/3/0/5/130539448/nozukepowutep.pdf
    • http://oncallediting.net/uploads/1/3/0/7/130776580/179974.pdf
    • http://alsant.com/uploads/1/3/0/5/130589360/6373045.pdf
    • http://paraviontheory.com/uploads/1/3/0/7/130776042/5a76a38.pdf
    • http://liviace.me/uploads/1/3/0/6/130604349/4983256.pdf
    • http://shotovercamera.com/uploads/1/3/0/4/130436173/2841583.pdf
    • http://diminexnz.com/uploads/1/3/0/3/130313319/vewetefeno.pdf
    • http://mission3075.org/uploads/1/3/0/5/130590717/ab58467.pdf
    • http://novateckfloor.com/uploads/1/3/0/6/130639321/pukajada.pdf
    • http://rollersrelics.com/uploads/1/3/0/3/130324050/zokogurun-nugexe-bazedifo.pdf
    • http://gardenstateenginedynamics.com/uploads/1/3/0/2/130289213/rimule.pdf
    • http://ki5fao.com/uploads/1/3/0/3/130313063/jowozikefigoxep-sojabunejugaga.pdf
    • http://layanshaheen.com/uploads/1/3/0/6/130639468/f3c34e369adf7.pdf
    • http://maplevalleyplastic.net/uploads/1/3/0/3/130313167/sekegisux.pdf
    • http://www.jwllrybyjade.co.uk/uploads/1/3/0/4/130476712/sovotemivovuzu.pdf
    • http://pragueprivatetransfers.com/uploads/1/3/0/5/130589229/130589229.html#nets+of+3d+shapes+maths+is+fun
    • http://ki5fao.com/uploads/1/3/0/3/130313063/jowozi

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003edb.bin
83459e82cebe561b9e65dda6a09953c9e35f75e5df0fa62a624e1833cc5b8086		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3EDB 1708 bytes
font_01_sfnt_off000049ec.bin
4b4a526cc759e2315a74238ab0fc72c345b9608d07eca74c7e43c2adbdb3612e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x49EC 8216 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.