Malicious PDF — malware analysis report

Static analysis result for SHA-256 48418f1eef4ad3c6…

MALICIOUS

PDF

37.8 KB Authoring application: SWFTools
MD5: 19e890ae89b2c04c7e4c13a07fa4ae7c SHA-1: 792053efd35cabcc43756a8729baadfeb6f2f0cf SHA-256: 48418f1eef4ad3c6e1d208f472f8ccb33a2821db8b1018285e672e61b0eb34b0
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded links to external PDF files hosted on various domains. This behavior is indicative of a link farm or a distribution mechanism for further malicious content, as flagged by the PDF_SEO_LINK_FARM heuristic. The ML classifier and ClamAV detection further support its malicious nature. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://biblebasedleader.com/uploads/1/3/0/8/130814011/mafujobaj.pdf
    • http://poppinpioneervalley.com/uploads/1/3/0/5/130588492/4128240.pdf
    • http://lambertservisi.com/uploads/1/3/0/7/130739376/2980928.pdf
    • http://www.crossroadsgirl.com/uploads/1/3/0/4/130436054/javekuleniboti-fuwufavan-zolosekevo-medibulufej.pdf
    • http://americanlandscapingservice.com/uploads/1/3/0/5/130590043/845945516c2.pdf
    • http://rhonddaladieshockey.co.uk/uploads/1/3/0/7/130775002/kalad.pdf
    • http://gamefarm.org/uploads/1/3/0/7/130775701/9591686.pdf
    • http://thedivineexpedition.com/uploads/1/3/0/8/130813988/gurijiduziwipogafafa.pdf
    • http://localator.net/uploads/1/3/0/2/130271076/bopaf_mezujono_fasebalokolif_kimoke.pdf
    • http://swepta.com/uploads/1/3/0/4/130483210/7718706.pdf
    • http://stlouiswireless.net/uploads/1/3/0/4/130436137/3bfc3b154d3c7.pdf
    • http://virtual-humans.com/uploads/1/3/0/7/130776836/7233375.pdf
    • http://popmetals.com/uploads/1/3/0/2/130289205/e83d9a.pdf
    • http://db03.en-linea.com/uploads/1/3/0/2/130272483/dukifuxiwurajutaluju.pdf
    • http://mostlytech.com/uploads/1/3/0/4/130483417/zufavelavod.pdf
    • http://www.bareroot.co/uploads/1/3/0/5/130588419/ac30e4f7eb7.pdf
    • http://the-wild-moon.com/uploads/1/3/0/5/130588433/de554aa.pdf
    • http://holoholofuntravel.com/uploads/1/3/0/7/130775198/vukigororuvigizuma.pdf
    • http://mci-ourhotelsportal.devsite-1.com/uploads/1/3/0/5/130550704/130550704.html#the+haunting+of+hill+house+is+luke+dead
    • http://americanlandscapingservice.com/uploads/1/3/0/5/1

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003679.bin
c7c4e44df0f4a28d89bbce2e81f1daaa9a0683126f9d9f9da2ecd597f4e923b5		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3679 7812 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.