Malicious PDF — malware analysis report

Static analysis result for SHA-256 4521afb7a2ae6ccd…

MALICIOUS

PDF

45.1 KB Authoring application: PDFedit
MD5: de6f3c55a8194e521235f8168a5e3f5f SHA-1: 45c3187261f26714e8b2ff8ff9c67efb9203eeff SHA-256: 4521afb7a2ae6ccd486debfed02866d78a29b3ccd349d6bc0a96d5b906567f66
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded links to external PDF documents hosted on various domains, indicating a link farm or SEO manipulation tactic. The ClamAV detection and ML classifier strongly suggest malicious intent, likely related to phishing or distributing further malware. No scripts were extracted, but the primary attack pattern involves directing users to a network of potentially malicious or spam-related content.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://oilgasconsultinginc.com/uploads/1/3/0/7/130739260/jotagolotugam.pdf
    • http://million-minds.org/uploads/1/3/0/3/130313641/wuvofugotelusixu.pdf
    • http://blindsquirrelcreativedesign.com/uploads/1/3/0/6/130621619/1371039.pdf
    • https://pulugifolebiva.weebly.com/uploads/1/3/0/4/130435702/kuvufonurusurukikifu.pdf
    • http://prorealgames.com/uploads/2020/01/29/ac13372d125ab.pdf
    • http://mymathtutoring.com/uploads/1/3/0/2/130273962/ddf71f.pdf
    • http://nvclosedeals.com/uploads/1/3/0/4/130479435/bofemujod-junijipaxidiz.pdf
    • http://reifierentertainmentdevelopment.com/uploads/1/3/0/6/130621272/3442868.pdf
    • http://otherworldlywaxesandwhatever.com/uploads/1/3/0/7/130739238/2256502.pdf
    • http://studiocitynorth.com/uploads/1/3/0/6/130604725/biwilagek.pdf
    • http://racefkc.com/uploads/1/3/0/5/130551335/130551335.html#architecture+portfolio+templates

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001250.bin
6292f20942795135de7d709d70c7489b43dd4e97d828158db66bd4e3adc0613c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1250 7712 bytes
font_01_sfnt_off00006a1d.bin
779aa567746046747dac965df7fdfb06ff632674a0a99ce247a327bf89f0fa63		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6A1D 16036 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.