Malicious PDF — malware analysis report

Static analysis result for SHA-256 3da43148bbb0a495…

MALICIOUS

PDF

58.7 KB Authoring application: Solid Converter PDF
MD5: d80ac29c46079a90b7df28464c893266 SHA-1: 6807c4aa3e9ecc010955dc662a0da64cd69b2fda SHA-256: 3da43148bbb0a495776fffaffb8d5a6bd52affa8afc38e55b8314771d389057b
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF document was flagged by ClamAV as Pdf.Phishing.TtraffRobotInstall-7605656-0 and a machine learning classifier. Static analysis revealed a PDF_SEO_LINK_FARM heuristic firing, indicating the presence of numerous external links within the document. These links, such as http://artbygirls.com/uploads/1/3/0/4/130436154/7a4915.pdf, are likely used to redirect users to malicious sites. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://artbygirls.com/uploads/1/3/0/4/130436154/7a4915.pdf
    • http://screenlo.com/uploads/1/3/0/5/130550731/5902924.pdf
    • http://www.quantumstringsoftware.com/uploads/1/3/0/7/130775511/a2ac2270cc61be5.pdf
    • http://timmas.space/uploads/1/3/0/5/130551457/xipom_tokin_potasujawujap_gosek.pdf
    • http://scottspeanuts.com/uploads/1/3/0/6/130621125/4637532.pdf
    • http://www.pahoawoodworks.com/uploads/1/3/0/4/130479082/fugajet.pdf
    • http://mta-sts.foxchapelnewcomers.org/uploads/1/3/0/5/130590279/6566894.pdf
    • http://moderneroticart.com/uploads/1/3/0/5/130590051/505253.pdf
    • http://padeljobs.org/uploads/1/3/0/2/130270796/somukazag.pdf
    • http://rqgenesis.co/uploads/1/3/0/5/130588806/1a1be.pdf
    • http://soteam.org/uploads/1/3/0/2/130287401/4831792.pdf
    • http://myowild.net/uploads/1/3/0/6/130621525/wuduzovurexawokimu.pdf
    • http://pmc2u.com/uploads/1/3/0/6/130605248/vasevus.pdf
    • http://doorado.net/uploads/1/3/0/7/130775209/6762995.pdf
    • http://boganesque.com/uploads/1/3/0/6/130639145/kaguneveriwipef.pdf
    • http://ptinscottsdale.com/uploads/1/3/0/5/130550953/272209.pdf
    • http://songarts.com/uploads/1/3/0/4/130436209/219869.pdf
    • http://myfantasyfootballworld.com/uploads/1/3/0/5/130551526/pimuviwadi-nenulik-lexelizuzedudez.pdf
    • http://ouachitabehavioralhealth.net/uploads/1/3/0/5/130589223/8268197.pdf
    • http://lukasnotten.com/uploads/1/3/0/6/130639887/zezevijesu_xigufap.pdf
    • http://mainefarmerscollective.com/uploads/1/3/0/7/130740510/8d062db.pdf
    • http://theknotleather.com/uploads/1/3/0/8/130874541/nomivirafug.pdf
    • http://www.jchambersconstruction.com/uploads/1/3/0/6/130639542/megubidejowowe_luxukige_fatefam_lolowikozisad.pdf
    • http://radiantlifeacademy.org/uploads/1/3/0/3/130324248/fuxorupige.pdf
    • http://metroartdesign.com/uploads/1/3/0/5/130539099/xodenatasona-xakupi-bezupimozede-piwobuzodemu.pdf
    • http://www.mccorkleagsales.com/uploads/1/3/0/9/130969980/130969980.html#syntax+score+ii+pdf

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001248.bin
a0ee944431b29055a460d380055f57bca1c8aff750679ba379ef77c392f2714a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1248 8604 bytes
font_01_sfnt_off000091e7.bin
b3affdfdfee497c2d3230853582529cf395d265bfdbb8cde7d84ae9c33602211		 pdf-font-stream PDF embedded font (sfnt) at offset 0x91E7 16036 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.