Malicious PDF — malware analysis report

Static analysis result for SHA-256 4370792ea5b688b6…

MALICIOUS

PDF

43.6 KB Authoring application: Serif PagePlus
MD5: a204bce45ec07c3e839ad6618c53517e SHA-1: 2fa074ce41019c54f446ea47a4acf7b38b9db822 SHA-256: 4370792ea5b688b69dae6f89f4da516abd67fcb41ec69fff3d73c5c9a9af90c5
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded URLs pointing to other PDF files hosted on various domains. This pattern is indicative of a link farm or a distribution mechanism for further malicious content. The ClamAV detection and ML classifier strongly suggest malicious intent, aligning with the PDF_SEO_LINK_FARM heuristic.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://mohawklumbercom.com/uploads/1/3/0/6/130639343/442983.pdf
    • http://neuroplastique.com/uploads/1/3/0/6/130639757/tubulu-lapudiwawabujer.pdf
    • http://nkbblockchain.com/uploads/1/3/0/6/130604910/bezeba.pdf
    • http://red4edactionnc.com/uploads/1/3/0/8/130814526/logegevifaruse-munolibimew-doxagidezomede.pdf
    • http://aclifesciences.biz/uploads/1/3/0/4/130435763/516b72a91a12d.pdf
    • http://moadim.net/uploads/1/3/0/5/130590312/8181c.pdf
    • http://oslorelocationservices.com/uploads/1/3/0/7/130776516/fivadaniromunu_tolupodepiva_tesezurize.pdf
    • http://monashsoccerclub.com/uploads/1/3/0/5/130589223/vuwagomukawuz.pdf
    • http://ashesofren.com/uploads/1/3/0/7/130739522/rumevajuf.pdf
    • http://virginiaconcretepaving.com/uploads/1/3/0/6/130604955/rumuligibexakid.pdf
    • http://mx.dancebykris.com/uploads/1/3/0/2/130288326/8612368.pdf
    • http://thenothingman.com/uploads/1/3/0/6/130620882/mijopelit.pdf
    • http://webdisk.sig-group.co.za/uploads/1/3/0/6/130639270/8a19c03bbccdec.pdf
    • http://alt-davos.club/uploads/1/3/0/5/130550993/leretirug-rewodunusi-nejituve.pdf
    • http://alexgumpel.com/uploads/1/3/0/8/130813458/sawodemoz.pdf
    • http://mutating.net/uploads/1/3/0/7/130775258/wogom_pafipumuk.pdf
    • http://taurum.ch/uploads/1/3/0/4/130483606/varuxuragin.pdf
    • http://beesbizz.com/uploads/1/3/0/7/130739416/tesitifeme-xuwisetozajoz.pdf
    • http://provencherdesigns.com/uploads/1/3/0/5/130589050/zibonizovuguj_susoziwomufe_xezujusi.pdf
    • http://mikepaganrealtor.com/uploads/1/3/0/4/130435939/legasibupatisip-vobiwi-zukok-rovekikedene.pdf
    • http://fly5c.bpmtc.com/uploads/1/3/0/8/130873833/130873833.html#how+do+i+turn+my+pages+document+into+a+pdf

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003cd0.bin
e91619dfd4c72a85464d95ef1ba4e67df13020651c42071bafbe521a61d9f7fc		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3CD0 2652 bytes
font_01_sfnt_off000048f5.bin
ea35a6cfc24eacf940c0eeb9a2ea114ad2107bfaa862296d107d727053fc83e0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x48F5 8472 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.