Malicious PDF — malware analysis report

Static analysis result for SHA-256 4c12be3b9b7866fb…

MALICIOUS

PDF

103.1 KB Authoring application: Smallpdf Desktop
MD5: 39c8d232378dbd4918f015ef421ec581 SHA-1: 98f48bff161e9e8247770148047812e092ea4010 SHA-256: 4c12be3b9b7866fbe88335af5103f59b34765b058a3b7d082fc654a34bc906a2
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of external links, a technique often used for SEO manipulation or to redirect users to malicious content. ClamAV identified this as 'Pdf.Phishing.TtraffRobotInstall-7605656-0', indicating a phishing or traffic redirection purpose. The ML classifier also strongly flagged this PDF as malicious. No scripts were extracted, but the extensive link farm suggests a delivery mechanism for further malicious activity.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9953

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://bbp-phnx1.intra.bradleybeachpd.com/uploads/1/3/0/2/130289424/cddee422c3c16b.pdf
    • http://hostmaster.rgadesignquilts.com/uploads/1/3/0/6/130620845/kamifolaxonobobipun.pdf
    • http://bimpliciti.net/uploads/1/3/0/5/130543667/2267885.pdf
    • http://northhobby.us/uploads/1/3/0/6/130603997/wogikomilik-lokepunaremar-rekopixugere.pdf
    • http://diamondviewfarms.com/uploads/1/3/0/4/130483862/3867473.pdf
    • http://treemendousnursery.com/uploads/1/3/0/7/130775111/nonitimazemija-xegof-bopet.pdf
    • http://dadevilleband.com/uploads/1/3/0/5/130590577/cf44141.pdf
    • http://minhavidaminhasescolhas.com/uploads/1/3/0/2/130270863/xofigutu_wusex_jeruxamojiroj.pdf
    • http://ddsdestinations.net/uploads/1/3/0/7/130775853/gezurekakiwu-bomasonimu.pdf
    • http://jwlabs.dev/uploads/1/3/0/2/130287401/xiron.pdf
    • http://www.browngirlfearless.com/uploads/1/3/0/5/130588843/robijesukuse_jovoja_lezofimisinu_vekorerajo.pdf
    • http://sijitech.com/uploads/1/3/0/5/130539652/c51184720a407d.pdf
    • http://hiyeller.com/uploads/1/3/0/7/130776075/018a8327f251221.pdf
    • http://74-123-77-162.mgwnet.com/uploads/1/3/0/4/130436171/rikedumav-foxemagan-dapabawopil-paxobizixe.pdf
    • http://affordableinsurancedirect.com/uploads/1/3/0/4/130488415/wakinazugin.pdf
    • http://carrieandandrew.com/uploads/1/3/0/4/130494059/juburoxidibukez.pdf
    • http://www.business-fedex.com/uploads/1/3/0/8/130874470/jenibanex_nunuvisogatujil_jadexov_serefo.pdf
    • http://shit-facedshakespeare.com/uploads/1/3/0/5/130550768/229b38ccce632.pdf
    • http://lifetunesonline.net/uploads/1/3/0/5/130589228/lejulolafefudi.pdf
    • http://www.die-hexen-haus.com/uploads/1/3/0/8/130814706/jowatupudedikegi.pdf
    • http://mta-sts.littleindiarestaurant.ca/uploads/1/3/0/3/130323186/dejenol.pdf
    • http://mx.alare.net/uploads/1/3/0/7/130775431/8069922.pdf
    • http://taxauctiontitle.com/uploads/1/3/0/6/130620551/1775951.pdf
    • http://huangguanzuqiukaihuwang.br3h.com/uploads/1/3/0/7/130740112/130740112.html#kula+kundalini+shakti+jagran

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f666.bin
1723f1ced37cc89d69e30f3df6281c5e5fb8989544fd4587aa75b00c91af2fd0
pdf-font-stream PDF embedded font (sfnt) at offset 0xF666 1388 bytes
font_01_sfnt_off0000ffcf.bin
9ad3ddc18670591ede612048015cb5ac4f539323284233c0d1957819b1a9fb8b
pdf-font-stream PDF embedded font (sfnt) at offset 0xFFCF 6464 bytes
font_02_sfnt_off00011ace.bin
9121470d1a59b5408e38f359c80ce20d941b1430dcd6014d84793e282e6a40b0
pdf-font-stream PDF embedded font (sfnt) at offset 0x11ACE 20796 bytes