Malicious PDF — malware analysis report

Static analysis result for SHA-256 432071e0bc42e1f3…

MALICIOUS

PDF

48.0 KB Authoring application: Poppler-utils
MD5: 0ceeda59ca60d1eb8dbcc0a75d4b86a8 SHA-1: e16b00d7226003da857a0872d416a84d1893efe8 SHA-256: 432071e0bc42e1f350f9c950617f31fbc0a68dbf0eb851663cca9faa32734345
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of external links, a technique commonly used for SEO poisoning to drive traffic to malicious sites. The ClamAV detection and ML classifier strongly indicate malicious intent, likely related to phishing or malware distribution. The embedded URLs are the primary indicators of compromise, pointing to potentially compromised or malicious domains.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://movingmountains.services/uploads/1/3/0/6/130604054/supamuf.pdf
    • http://trinitycastle.com/uploads/1/3/0/5/130539866/8461715.pdf
    • https://novazixiwevop.weebly.com/uploads/1/3/0/4/130478882/wovisegixatadebuto.pdf
    • http://pudgery.com/uploads/1/3/0/7/130740262/4110187.pdf
    • http://schooldietology.space/uploads/1/3/0/6/130603907/1837187.pdf
    • https://nisevade.weebly.com/uploads/1/3/0/2/130273915/zilivuvafafas.pdf
    • http://bardgames.org/uploads/1/3/0/6/130639428/tonalutegakevajeli.pdf
    • http://numaluvuf.familiarizarse.info/uploads/2020/01/28/6006104.pdf
    • http://rbcdublin.org/uploads/1/3/0/2/130289557/4f051959.pdf
    • http://wifeycosmetics.com/uploads/1/3/0/7/130740169/3990740.pdf
    • http://towneridgecleaners.com/uploads/1/3/0/4/130490561/9569214.pdf
    • http://mycreativeservices.space/uploads/1/3/0/5/130539111/453f17a8521e.pdf
    • http://brdpllc.com/uploads/1/3/0/6/130604815/130604815.html#radiologic+science+for+technologists+free+download

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000012fc.bin
3a6ad9986b9b55e238fbd64d8d1d88372600917462401963e8f3381554b34902		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12FC 8120 bytes
font_01_sfnt_off00007442.bin
448c4d4550ed59c7e8e80b6d66b986666620351883d23913e38401b861762e5b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7442 16368 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.