Malicious PDF — malware analysis report

Static analysis result for SHA-256 45e6676f0e4a92bf…

MALICIOUS

PDF

43.1 KB Authoring application: Inkscape
MD5: 1bfa3ce27561535b530bee337ccbd4e4 SHA-1: 50b1ea79e7355a38c955cedd228b9594a5a8bcd1 SHA-256: 45e6676f0e4a92bf2847adbe351eff67233aaa186f94c6d04350fa29f3ba090a
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded URLs pointing to other PDF files, a technique often used for SEO spam or to distribute malware. The ClamAV detection and ML classifier strongly indicate malicious intent. The heuristic 'PDF_SEO_LINK_FARM' confirms the presence of numerous external links, with 'www.taconinjaadventure.com' being a dominant host. No scripts were extracted from this sample, but the extensive link farm suggests a distribution or redirection mechanism.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.taconinjaadventure.com/uploads/1/3/0/5/130588674/zivokaw.pdf
    • http://snehsrivastava.com/uploads/1/3/0/6/130639786/7146037.pdf
    • http://webdisk.gitaarlesdamwoude.nl/uploads/1/3/0/7/130776656/6665419.pdf
    • http://unapologetic-access.com/uploads/1/3/0/3/130323251/2ba06907b4cf4.pdf
    • http://simsoup.com/uploads/1/3/0/6/130639201/1e26b505a.pdf
    • http://coryule.com/uploads/1/3/0/4/130494743/noluredoxoj.pdf
    • http://robertdickstudionyc.com/uploads/1/3/0/2/130273576/6399202.pdf
    • http://pascorealestateblog.org/uploads/1/3/0/2/130288818/zositafiko.pdf
    • http://denisonisdbands.org/uploads/1/3/0/5/130551445/47d2afc6b8.pdf
    • http://eidarchitect.com/uploads/1/3/0/5/130589102/befavowi-fogefe-lubufebetofox.pdf
    • http://lucid-labview.net/uploads/1/3/0/2/130270953/6647187.pdf
    • http://mysportsmemory.com/uploads/1/3/0/6/130620406/gonuxigegeze_xobuwerelir.pdf
    • http://www.newlifesocal.org/uploads/1/3/0/9/130969226/f9f8170.pdf
    • http://u-ehs.com/uploads/1/3/0/7/130775965/65349e539503df.pdf
    • http://budgetboutiquebeds.com/uploads/1/3/0/5/130550914/fepijunejukojulizu.pdf
    • http://genevievewilson.co/uploads/1/3/0/7/130775817/tuxox-zigadon-lovaj.pdf
    • http://fitness-private.com/uploads/1/3/0/3/130313619/liwam.pdf
    • http://hostmaster.nelsoncoaching.ch/uploads/1/3/0/5/130590312/db944ecc8.pdf
    • http://carpetcleanerwaukesha.com/uploads/1/3/0/6/130622063/zomotakizatuv.pdf
    • http://optyktyminski.pl/uploads/1/3/0/6/130605393/34987210185f05.pdf
    • http://home.facto.pro/uploads/1/3/0/4/130488417/vubawabepi.pdf
    • http://www.librecommelart.ca/uploads/1/3/0/7/130776152/jetowafirelosizizoxe.pdf
    • http://informationsuperglacier.net/uploads/1/3/0/5/130550697/funapedaxiwixefekit.pdf
    • http://lineaamericana.com/uploads/1/3/0/4/130490488/5565645.pdf
    • http://chengsin-caf.com/uploads/1/3/0/6/130620293/4485424.pdf
    • http://kathleen-cortez.pleasingfood.com/uploads/1/3/0/5/130546024/130546024.html#exercices+sur+adjectifs+demonstratifs

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000040a6.bin
5ea25719d3e59813420905df13cf2a34e83f401b75ab2320cf2de2f10a46bdd4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x40A6 10164 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.