Malicious PDF — malware analysis report

Static analysis result for SHA-256 4b1eac8168fc7110…

MALICIOUS

PDF

39.5 KB Authoring application: Soda PDF
MD5: 2c18443266c73c19ff09e0e24f691748 SHA-1: ee1e0668cb810eee1c892753ba27ec57fa862f6e SHA-256: 4b1eac8168fc7110dc044d175be6039dde6ef0ffba16ad64b899de018928e948
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of external links to other PDF files hosted on various domains, a technique commonly used for SEO poisoning or phishing lures. The ClamAV detection and ML classifier strongly indicate malicious intent. The embedded URLs are the primary indicators of compromise, suggesting a redirection or download campaign.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://roamartrentals.com/uploads/1/3/0/2/130272850/2814722.pdf
    • http://ilonggo.net/uploads/1/3/0/7/130739756/6945810.pdf
    • http://achildofwonder.com/uploads/1/3/0/5/130543320/ratewizekujan_mebuzuresa_wemamiruwes_jotulexajafos.pdf
    • http://nancyhamiltonmyers.com/uploads/1/3/0/8/130814353/4151115.pdf
    • http://petportraitsbyjanedolan.com/uploads/1/3/0/7/130740218/pubeloguroge.pdf
    • http://victordata.net/uploads/1/3/0/2/130270874/5a26a4ea8fef87.pdf
    • http://mychinesewatch.com/uploads/1/3/0/5/130539097/130539097.html#how+to+read+the+cumulative+standard+normal+distribution+table

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001157.bin
390ca231e4f21938dae8d68d49f7af6db9994b0c28cf216a89ab3f6bab37074e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1157 8512 bytes
font_01_sfnt_off00005e05.bin
b795b88f418ec6b252d2a6cae9b2ec3122de3f8aa5b1fbb66e256d08d9cab0da		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5E05 3016 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.