Malicious PDF — malware analysis report

Static analysis result for SHA-256 45b84c74f9740626…

MALICIOUS

PDF

31.1 KB Authoring application: pstoedit
MD5: 30529f8114e9bc119be76cfd618ee9ed SHA-1: 519303e5e5391ebd96869c6cc346c6d934e21fc0 SHA-256: 45b84c74f9740626c88be9e28b431969841c516da67695a0857fd9892413cfae
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded external links, a technique often used for SEO manipulation or to distribute further malicious content. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the ML classifier output strongly indicate malicious intent. The document body itself contains fragmented text related to factoring and algebra, which appears to be a lure to disguise the malicious nature of the links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://storybrooksentertainment.com/uploads/1/3/0/2/130287972/zikadoj.pdf
    • http://plancul-lehavre.net/uploads/1/3/0/7/130775838/a8638d01e64.pdf
    • http://www.immigrationrus.com/uploads/1/3/0/6/130639924/jejevefiwezefes-xotilikuk.pdf
    • http://nomoresound.com/uploads/1/3/0/5/130588352/3899954.pdf
    • http://www.hollyemann.com/uploads/1/3/0/7/130738753/1268394.pdf
    • http://bestcheaptrips.net/uploads/1/3/0/7/130775358/5706447.pdf
    • http://500palisades.com/uploads/1/3/0/7/130740173/politofudapese_bojepora.pdf
    • http://swineandvinefarm.com/uploads/1/3/0/4/130476039/relelifovojumo.pdf
    • http://mistress-death.com/uploads/1/3/0/7/130776715/wonupipixuxi-dukuzugodijov-ranos.pdf
    • http://msvieirasclassroom.com/uploads/1/3/0/3/130323794/f89d1601c5881.pdf
    • http://www.besthomeoflabradors.net/uploads/1/3/0/5/130551697/dunulamuzexa.pdf
    • http://brbayouth.com/uploads/1/3/0/3/130379061/felipol.pdf
    • http://nailtube.nl/uploads/1/3/0/5/130590123/130590123.html#factoring+quadratic+formula+kuta

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000200c.bin
c31ddb21940c7b60a9f65e52b50815592cda52cf0e55bde965411682f72342b1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x200C 8244 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.