Malicious PDF — malware analysis report

Static analysis result for SHA-256 3b4e68bbb6287416…

MALICIOUS

PDF

36.2 KB Authoring application: QPDF
MD5: 0acc55a1742774ed2808174799b20714 SHA-1: daa16b1847fd08b87d3644d3fe7ac1cf2a1eb610 SHA-256: 3b4e68bbb6287416565313be34b85a8d29d7d88e988fbc456c7ebc3e092f6c29
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file was flagged by multiple heuristics, including ClamAV and a machine learning classifier, indicating malicious intent. The PDF_SEO_LINK_FARM heuristic identified a large number of external links, suggesting a phishing or redirection campaign. The embedded URLs are likely used to host further malicious content or lead users to phishing sites.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.willspointbluebird.org/uploads/1/3/0/8/130813897/vufogomunukamek.pdf
    • http://mudwater.org/uploads/1/3/0/6/130639635/rudemebiwale.pdf
    • http://acousticat.com/uploads/1/3/0/7/130739828/0d005d6b337d7.pdf
    • http://oldposthillfarm.net/uploads/1/3/0/6/130621905/sopubepuzemufix.pdf
    • http://ariana-johnson.com/uploads/1/3/0/4/130491075/pejagazum.pdf
    • http://thebeautifulwomanjb.com/uploads/1/3/0/4/130488414/sezalozunakadat_jejofugirodozu.pdf
    • http://veteransmusicfest.com/uploads/1/3/0/5/130543141/kugawo_kezinusula.pdf
    • http://minimalclothing.shop/uploads/1/3/0/5/130551257/3175826.pdf
    • http://kevinmcdonaldart.com/uploads/1/3/0/6/130605198/7365983.pdf
    • http://150daily.com/uploads/1/3/0/8/130814042/8b4dc0.pdf
    • http://mylebleutriad.com/uploads/1/3/0/4/130490410/poxixizagadefojula.pdf
    • http://www.novasparockyhill.net/uploads/1/3/0/6/130640235/1755101.pdf
    • http://mobileonegaming.com/uploads/1/3/0/5/130551880/09eb19414854.pdf
    • http://sqlthemovie.com/uploads/1/3/0/4/130483303/e66ac7e00.pdf
    • http://veraluceconsulting.com/uploads/1/3/0/6/130604692/jagegazesifex.pdf
    • http://anitagoodidea.com/uploads/1/3/0/7/130775784/a7bdc92f4.pdf
    • http://adnocfuels.com/uploads/1/3/0/7/130739706/7090009.pdf
    • http://www.shiatsumarikatuhkala.com/uploads/1/3/0/2/130289640/2cefcac65d7.pdf
    • http://mytayloralexander.com/uploads/1/3/0/6/130621856/03796.pdf
    • http://playpass.net/uploads/1/3/0/4/130476263/kirowawemikat.pdf
    • http://sanclementecarillon.com/uploads/1/3/0/6/130640227/lejuroti.pdf
    • http://moorereplacements.net/uploads/1/3/0/7/130740262/lemerizer.pdf
    • http://sunflowerpressnd.com/uploads/1/3/0/7/130739648/a32607.pdf
    • http://kingshotelsgroup.devsite-1.com/uploads/1/3/0/2/130270837/130270837.html#free+worksheets+adding+2+digit+numbers+without+regrouping

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002ccd.bin
bce39aa9bdd7ac136841a33dd72b91a05c53202bd30b3d49aee01d25eb56e724		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2CCD 7232 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.