Malicious PDF — malware analysis report

Static analysis result for SHA-256 4356db4ee98ed5db…

MALICIOUS

PDF

36.0 KB Authoring application: Nitro PDF
MD5: f82d6cd1a8ef25bd1aa72de8dfa2ba04 SHA-1: 1e949d4c57abf67488094e761a936c62b5dd2ad2 SHA-256: 4356db4ee98ed5db11b96fd29bb45d28ac5ee25bf21085d002b20ba933003d95
150 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The PDF contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic, pointing to various domains. This is indicative of a link farm used to artificially boost search engine rankings, often employed for phishing or distributing malicious content. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a phishing or traffic redirection intent. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://74-123-78-174.mgwnet.com/uploads/1/3/0/4/130488544/gesizime.pdf
    • http://quizzzila.com/uploads/1/3/0/2/130272606/ecb4c.pdf
    • http://www.coloradoprofessionalnetwork.com/uploads/1/3/0/2/130292073/46c22e0.pdf
    • http://e2biopharma.com/uploads/1/3/0/4/130477633/988b59f3c.pdf
    • http://shrewsburycondo.com/uploads/1/3/0/4/130436337/5619970.pdf
    • http://lemonxami.com/uploads/1/3/0/4/130436525/rogoneribumaku-kakoritaluzoda-kibumonomudijid.pdf
    • http://jennycarroll.com/uploads/1/3/0/7/130739027/zakanaxedoguluxejozi.pdf
    • http://sunnystats.com/uploads/1/3/0/7/130776200/jitoturo.pdf
    • http://www.nosnow.io/uploads/1/3/0/8/130873715/ef389.pdf
    • http://cinema-paradiso.info/uploads/1/3/0/9/130969847/2713402.pdf
    • http://www.mutinymugs.net/uploads/1/3/0/8/130874066/gedujeru-nulemise-figan-lipewibog.pdf
    • http://www.collincurry.com/uploads/1/3/0/4/130436239/jaxemozitubunojafa.pdf
    • http://thepudgery.com/uploads/1/3/0/3/130323109/zejakezovuzulegetopo.pdf
    • http://asharperimage.ca/uploads/1/3/0/5/130543874/zuvojulefinerovag.pdf
    • http://mail.aussies.co/uploads/1/3/0/7/130776687/9912836.pdf
    • http://exchange.panaprint.com/uploads/1/3/0/7/130776826/8069571.pdf
    • http://webmail.antiochmissionarybaptist.org/uploads/1/3/0/6/130640021/5151088.pdf
    • http://enjoni-cafe.com/uploads/1/3/0/3/130313561/97e41a6c92da.pdf
    • http://miraclemaintenance.biz/uploads/1/3/0/4/130435945/tilukawe.pdf
    • http://amdberlin.com/uploads/1/3/0/6/130639266/giwoguja.pdf
    • http://waterdogpaddleboarding.com/uploads/1/3/0/6/130604694/mexar_tuzakadizijipo.pdf
    • http://74-123-77-70.mgwnet.com/uploads/1/3/0/6/130603873/130603873.html#what+gene+causes+sickle+cell+anemia
    • http://sunnystats.com/uploads/1/3/0/7/130776200/jitotur

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002d49.bin
8d3ccde198d41d9eb79644fd2e7bb36fc630e4f63f8c2cf0501d41972e8625e5		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2D49 7496 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.