Malicious PDF — malware analysis report

Static analysis result for SHA-256 457284bad2e8eef9…

MALICIOUS

PDF

38.0 KB Authoring application: Smallpdf Desktop
MD5: e2c306bba34fc94748dd4f0154239593 SHA-1: ef5fa2c3540431c200dc6017f8f33217ffb6021e SHA-256: 457284bad2e8eef953c3f9503c6a9d097170d82ab9143ad219bd6a5b76956b2e
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF file contains a large number of external links, as indicated by the PDF_SEO_LINK_FARM heuristic. The ClamAV detection and ML classifier also strongly suggest malicious intent. The embedded URLs point to other PDF files, likely serving as a distribution mechanism for further malicious content or phishing attempts.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://newfoodie.net/uploads/1/3/0/5/130589009/turagokupukizilelepo.pdf
    • http://theerasak.com/uploads/1/3/0/7/130776381/c2a79f058ce7a.pdf
    • http://paulrainmaker.com/uploads/1/3/0/5/130539300/86a629012a80.pdf
    • http://meridenoilcompany.com/uploads/1/3/0/6/130620437/413ff88.pdf
    • http://ameliatseng.com/uploads/1/3/0/6/130604449/vipisujepemonofufu.pdf
    • http://warsquare.net/uploads/1/3/0/6/130620309/fdd81c19981.pdf
    • http://www.wildtundraquest.com/uploads/1/3/0/6/130621240/wofuvuwex.pdf
    • http://trishasxtremeclean.net/uploads/1/3/0/2/130272928/ebaa6c.pdf
    • http://perceptualteaching.org/uploads/1/3/0/4/130476844/769ac33ac45bec.pdf
    • http://bennettallenwood.com/uploads/1/3/0/4/130478975/8687251.pdf
    • http://plannedgivingnews.com/uploads/1/3/0/7/130739480/5880356.pdf
    • http://madewithlovebydanielle.com/uploads/1/3/0/6/130621361/eebe79a7e.pdf
    • http://larcadacreixement.com/uploads/1/3/0/5/130588676/nemid.pdf
    • http://exitplanningcollaborative.com/uploads/1/3/0/4/130489465/sizuvobudanuw-vepixamagixawa.pdf
    • http://matildaparrish.com/uploads/1/3/0/8/130874385/tukapimug.pdf
    • http://rhondaatrottministries.com/uploads/1/3/0/6/130639885/pemubosizetijit.pdf
    • http://drbrewer.net/uploads/1/3/0/7/130739917/pabafotojezok_mixamowux_limezuzu.pdf
    • http://phhlca.org/uploads/1/3/0/3/130323430/wofevonosater-lafifosev-durifowogu.pdf
    • http://galaxiafitness.net/uploads/1/3/0/7/130739933/8c3fb7be.pdf
    • http://myneverendingbucketlist.com/uploads/1/3/0/7/130775372/linagam_lirej_kezemofedaj_pedofakaw.pdf
    • http://unmysterium.com/uploads/1/3/0/4/130477083/8912428.pdf
    • http://ok-lendava.si/uploads/1/3/0/2/130291536/vudutudiga_godorarib_fonun_vesoruwofolit.pdf
    • http://kingshotelsrussiansummary.devsite-1.com/uploads/1/3/0/2/130271121/130271121.html#2019+calendar+with+indian+government+holidays+pdf
    • http://rhondaatrottministries.com/upload

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003247.bin
e8fab219bd5b72854bb99e49264b0ef98801fed94ca248facc93c847742b587e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3247 7960 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.