Malicious PDF — malware analysis report

Static analysis result for SHA-256 4346f59057ac99d1…

MALICIOUS

PDF

40.0 KB Authoring application: PDFedit
MD5: da8a5704a4daa72b5b6060718f286844 SHA-1: 160cebbe78fbec9389979d6ef11e33217b40ca74 SHA-256: 4346f59057ac99d1b9c31e622780d02867de5f4b29ebde498147c2b8392706c1
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded links to external PDF files hosted on various domains, as indicated by the PDF_SEO_LINK_FARM heuristic. This suggests a phishing or redirection campaign. The ML classifier and ClamAV detection strongly support the malicious verdict. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://servicedelocation.org/uploads/1/3/0/6/130621354/kerorisedol_xedog_lenaxam_pawixavibav.pdf
    • http://www.agmetalworx.com/uploads/1/3/0/5/130550968/xirapawuti-bepejiwozixek-jimasolul.pdf
    • http://convertingequipmentparts.com/uploads/1/3/0/6/130621501/217e83a148f7c.pdf
    • http://voicedoutcomesdirectory.com/uploads/1/3/0/3/130323124/rimenezarem-zedetaxuz.pdf
    • http://lexington-mls.com/uploads/1/3/0/4/130479008/dunikigiz.pdf
    • http://krsc.net/uploads/1/3/0/7/130775245/6043862.pdf
    • http://camptexas.com/uploads/1/3/0/4/130489386/5294547.pdf
    • http://musmuin.com/uploads/1/3/0/7/130775751/jowibisiratugonefise.pdf
    • http://www.chucktowncreations.com/uploads/1/3/0/7/130740330/medodujefopeze_zazufuxotex_ritevu_lowikipefimivi.pdf
    • http://www.hgssummerprograms.com/uploads/1/3/0/7/130739011/xunelogomat.pdf
    • http://h2-robotics.com/uploads/1/3/0/7/130775189/4fb068d7f.pdf
    • http://mta-sts.masoncitychristian.org/uploads/1/3/0/9/130970022/dedelu_puzopewine_savovaj_rimexe.pdf
    • http://electronic-escrow.com/uploads/1/3/0/5/130589396/xagovugu-gikas-wapid.pdf
    • http://alwoc.org/uploads/1/3/0/8/130814229/fe30d.pdf
    • http://analog.marketing/uploads/1/3/0/4/130435857/4405769.pdf
    • http://nobumarbella.devsite-1.com/uploads/1/3/0/2/130274301/130274301.html#colombia+world+cup+squad+2018+captain
    • http://servicedelocation.org/uploads/1/3/0/6/130621

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003e0c.bin
13b0bb1fb1655112154650c4f09fd247d0701fcf709c7a912f30cdc9689f2586		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3E0C 9304 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.