Malicious PDF — malware analysis report

Static analysis result for SHA-256 3bb54f34b11c41e1…

MALICIOUS

PDF

34.9 KB Authoring application: PDF Studio
MD5: ebf7b4806f89e507cbe9eb042f9ac40d SHA-1: 53a14e5d0fc9a79748436d758e65ee60c0d69bbb SHA-256: 3bb54f34b11c41e1e3d6c893292bc898d362950b1cb35ba0f0eb7eb04e13b190
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded links to external PDF files hosted on various domains, a technique often used for SEO manipulation or to distribute malicious content. The ClamAV detection and ML classifier strongly indicate malicious intent. The heuristic 'PDF_SEO_LINK_FARM' confirms the presence of numerous external links, with the first identified as http://agapeholisticaromatherapy.com/uploads/1/3/0/7/130739522/zepesasaxenixafupusu.pdf.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://agapeholisticaromatherapy.com/uploads/1/3/0/7/130739655/zepesasaxenixafupusu.pdf
    • http://fortheloveapparel.com/uploads/1/3/0/8/130814197/jalemu.pdf
    • http://community-band.com/uploads/1/3/0/5/130589384/vasek.pdf
    • http://betawilloughby.com/uploads/1/3/0/5/130544009/5309689.pdf
    • http://801fig.com/uploads/1/3/0/7/130739522/eef2715c85f1aff.pdf
    • http://053748270.com/uploads/1/3/0/5/130551597/26bfe.pdf
    • http://weeblysupport.org/uploads/1/3/0/5/130550895/1d0b3e4adf5.pdf
    • http://bronwynb.co/uploads/1/3/0/3/130323936/tepudezasijo.pdf
    • http://my-riverside-dui-lawyer.com/uploads/1/3/0/6/130604544/8007907.pdf
    • http://rcthelabel.net/uploads/1/3/0/7/130740297/melerarulevab.pdf
    • http://nativeuniques.com/uploads/1/3/0/7/130738960/4ad62ad54a3be0.pdf
    • http://officespace1999.com/uploads/1/3/0/6/130621024/b469e063a.pdf
    • http://metiscollege.ca/uploads/1/3/0/2/130291434/6653748.pdf
    • http://mycoredesigns.com/uploads/1/3/0/6/130620910/wewareworutofasu.pdf
    • http://northoakdesign.com/uploads/1/3/0/4/130479210/80518.pdf
    • http://host193.carmichaelnl.com/uploads/1/3/0/5/130551000/130551000.html#additive+manufacturing+3d+printing+courses
    • http://northoakdesign.com/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002d53.bin
2197133dcd319c6c0ecfff30e26017e543218b04b4fcd5c4013b59f741b83737		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2D53 7992 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.