Malicious PDF — malware analysis report

Static analysis result for SHA-256 49371901832687f8…

MALICIOUS

PDF

46.7 KB Authoring application: QPDF
MD5: 9e6b029ed50a0e4da5f3e59678779cfd SHA-1: c18b945dfd7abe7554fc3294eecf33d27f95759b SHA-256: 49371901832687f860db032ea31749ce0e82f6ec1ef8db2c6b6fcad9c6836608
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF file contains a link farm of 25 external PDF links, disguised as information about Doxycycline dosage. The primary heuristic indicates a mass external PDF link farm, and ClamAV identifies it as Pdf.Phishing.TtraffRobotInstall. The embedded URLs are likely part of a phishing or SEO spam campaign designed to drive traffic to malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9987

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://mta-sts.mx.northhaydenstorage.com/uploads/1/3/0/2/130287886/wezunuwodopa.pdf
    • http://jannarasanen.com/uploads/1/3/0/8/130813770/e0a984.pdf
    • http://lauralepre.com/uploads/1/3/0/3/130313193/4665032.pdf
    • http://nashvilledrones.com/uploads/1/3/0/5/130590592/242bd.pdf
    • http://mystaybuddy.com/uploads/1/3/0/6/130640006/mogovizolarol-lugawaz-notozoratib.pdf
    • http://bilicichconsulting.com/uploads/1/3/0/7/130739474/8b87dd9e.pdf
    • http://sdtranslationcenter.com/uploads/1/3/0/2/130288729/7f1ceed2.pdf
    • http://momhustleology.com/uploads/1/3/0/6/130620840/paminomunava.pdf
    • http://umbcs.com/uploads/1/3/0/7/130739376/e41aa91cc4a8f0.pdf
    • http://elwesal.com/uploads/1/3/0/6/130639110/6456e5db4270.pdf
    • http://mx.thenailsbar.net/uploads/1/3/0/4/130492229/407b0.pdf
    • http://americanpeerage.us/uploads/1/3/0/7/130776176/gedatumewererofuse.pdf
    • http://naturesintent.co/uploads/1/3/0/7/130775103/kozibivusoxalofi.pdf
    • http://89cougars30th.com/uploads/1/3/0/6/130640159/revabugatotapav.pdf
    • http://bodyworkbybarb.com/uploads/1/3/0/3/130323268/75621f1c05448.pdf
    • http://minimalwaste.net/uploads/1/3/0/6/130621161/8bb30c1b242e6.pdf
    • http://biodanzacuerpoyalma.com/uploads/1/3/0/6/130640018/995ab.pdf
    • http://dhruvautomations.com/uploads/1/3/0/6/130621285/fiputerizebixegiwaz.pdf
    • http://www.cbtcounsellingpsychotherapy.com/uploads/1/3/0/5/130588191/300502.pdf
    • http://resiliencesoaps.net/uploads/1/3/0/4/130488816/goxabe.pdf
    • http://noahlang.net/uploads/1/3/0/6/130604934/7446ee1.pdf
    • http://alexanderdeerprocessing.com/uploads/1/3/0/6/130604804/wibuzawab_gopak.pdf
    • http://portl.org/uploads/1/3/0/5/130589208/bde9285.pdf
    • http://simplyslime.shop/uploads/1/3/0/7/130775846/4023613.pdf
    • http://suitemeter.com/uploads/1/3/0/6/130621853/490a4b636c792.pdf
    • http://a1500770xstreamtravel.xsideas.com/uploads/1/3/0/5/130543476/130543476.html#doxycycline+dosage+for+acne+reviews

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003ab7.bin
779aa567746046747dac965df7fdfb06ff632674a0a99ce247a327bf89f0fa63		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3AB7 16036 bytes
font_01_sfnt_off00005213.bin
da5847adbcef1311da8346ae4df0885c7d29ce0e58b4c16d80b8df50f38c7fc0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5213 8144 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.