Malicious PDF — malware analysis report

Static analysis result for SHA-256 4256304bada75673…

MALICIOUS

PDF

39.2 KB Authoring application: GIMP
MD5: d847431fc0c1e4277149fc31fdfa8b2d SHA-1: 0113e685731afd4019eb1098c5a5a049f4f86ce5 SHA-256: 4256304bada75673d0ea0ab4bb1b58f2d721c68fe1bb796111621c15e5f0fd10
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded external links, a technique often used for SEO manipulation or to redirect users to malicious sites. The ClamAV detection and ML classifier strongly indicate malicious intent. The document body, though heavily truncated and containing garbled text, mentions 'Cholinesterase inhibitors usmle', suggesting a lure related to medical studies or exams, which is then linked to a network of PDF files hosted on various domains.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://serdogan.com/uploads/1/3/0/8/130874592/ca2b9dc7727cb94.pdf
    • http://www.theleanfigcoachingcompany.com/uploads/1/3/0/5/130550994/sasekovefizus_xebalelu_degiw_potekax.pdf
    • http://www.yourgirlwithadd.ca/uploads/1/3/0/8/130813645/tezitutiname.pdf
    • http://merx-group.com/uploads/1/3/0/7/130738824/8522003.pdf
    • http://somorra.com/uploads/1/3/0/5/130551920/tejutogobot.pdf
    • http://mmec.com.sg/uploads/1/3/0/2/130273616/lepoxiwirivo_wutirepijijuj.pdf
    • http://mshroff.net/uploads/1/3/0/3/130323952/virutedituwoza-jevujowad-wevowupetab.pdf
    • http://cowle.de/uploads/1/3/0/6/130640010/vedet.pdf
    • http://aconcaguaextreme.com/uploads/1/3/0/6/130603798/6387272.pdf
    • http://lazytfarm.com/uploads/1/3/0/6/130604309/rajufewadavima.pdf
    • http://smartgtrack.com/uploads/1/3/0/6/130621673/130621673.html#cholinesterase+inhibitors+usmle

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000037f1.bin
e2f1373bf3d70a40ff4276a486f0a1d2d32154e4f45ad1243a44c3d3b7d91cea		 pdf-font-stream PDF embedded font (sfnt) at offset 0x37F1 2652 bytes
font_01_sfnt_off000043cb.bin
9e7d4cfad065d0f3a7fc545731da0ab1526715cd60e042291f8839a19d9a8266		 pdf-font-stream PDF embedded font (sfnt) at offset 0x43CB 7704 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.