Malicious PDF — malware analysis report

Static analysis result for SHA-256 3e225405de2c4244…

MALICIOUS

PDF

43.0 KB Authoring application: SWFTools
MD5: 253b8a8109f7020e702361989ebdc996 SHA-1: cadc4da7675d87211d2845286b4ff3fb6d4c443d SHA-256: 3e225405de2c42447c35c234d63b02bc2d9eff5366aa38ddbc653462825095b8
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links to external PDF files hosted on various domains. This behavior is indicative of a link farm or a phishing campaign designed to drive traffic to potentially malicious content. The ClamAV detection and ML classifier further support its malicious classification.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://amazingamericanstv.com/uploads/1/3/0/4/130490019/751900.pdf
    • http://ssphotography.net/uploads/1/3/0/4/130435757/03130c1934.pdf
    • http://atlshoebank.com/uploads/1/3/0/5/130588779/wizulolexakida-dujuletulukufon.pdf
    • http://shoppivotalchocolates.com/uploads/1/3/0/6/130620510/6150051.pdf
    • http://nuvisionabroad.com/uploads/1/3/0/6/130604877/7c68498d.pdf
    • http://zakstronaut.com/uploads/1/3/0/3/130379912/419fadb5a40ee3.pdf
    • http://singbabysing.biz/uploads/1/3/0/6/130604173/wigunubugabal.pdf
    • http://cheryltesslersolitfoundation.com/uploads/1/3/0/3/130323642/pomegizibo.pdf
    • http://motorcyclespeakers.org/uploads/1/3/0/6/130604874/e8792.pdf
    • http://alessertraveledroad.com/uploads/1/3/0/2/130273843/1c36713bdc.pdf
    • http://pameladirnberger.com/uploads/1/3/0/7/130738637/130738637.html#spectrophotometric+determination+of+aspirin+lab+report

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000012a9.bin
1620cb198af1916414c53b9c1fb0914619c05f0619a29e9468f6cca2357c4385		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12A9 8680 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.