Malicious PDF — malware analysis report

Static analysis result for SHA-256 4d00f24524c3e0bd…

MALICIOUS

PDF

63.2 KB Authoring application: QPDF
MD5: c4f23b556cd38cfa6cd2677de3487d22 SHA-1: e447ecf488434136d1567ad8801ea5ec4dd51717 SHA-256: 4d00f24524c3e0bd0112ec5fc15874f7b8becbfdd5f04a1cdfff989f73d8564a
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of external links, many of which point to other PDF files hosted on similar domains. This is indicative of a link farm used to distribute malicious content, as flagged by the PDF_SEO_LINK_FARM heuristic. The ML classifier and ClamAV detection further support its malicious nature, identifying it as a phishing or malware distribution vehicle. The embedded URLs are the primary IOCs, likely serving as download locations for further payloads.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://535283907160260040.com/uploads/1/3/0/5/130542736/ff17ef.pdf
    • http://douglaspharmachems.com/uploads/1/3/0/5/130545480/5447085.pdf
    • http://empoweredyou.solutions/uploads/1/3/0/7/130775649/lufaturunuvil.pdf
    • http://therapyforblackboys.org/uploads/1/3/0/6/130639728/worerapuriwarupanage.pdf
    • http://tnblistecadeau.ca/uploads/1/3/0/2/130272636/rafuzebidegowuga.pdf
    • http://cassusfunnels.com/uploads/1/3/0/4/130435811/309158.pdf
    • http://www.caitlinlangley.com/uploads/1/3/0/6/130639810/9633031.pdf
    • http://farmersmarketdog.com/uploads/1/3/0/5/130551086/kulufabesate.pdf
    • http://maxhdefence.com/uploads/1/3/0/7/130739284/busaz-duzexaxarom-lawevinixav-najoperefofo.pdf
    • http://jetcricketline.com/uploads/1/3/0/7/130776823/6369130.pdf
    • http://mitchgallagherband.com/uploads/1/3/0/2/130289623/6005605.pdf
    • http://accjcsfund.org/uploads/1/3/0/8/130874297/wododeguvudusadoza.pdf
    • http://uteo.us/uploads/1/3/0/6/130604104/gamiriselisal.pdf
    • http://nicksandmay.com/uploads/1/3/0/2/130273893/2333845.pdf
    • http://spklyf.com/uploads/1/3/0/7/130775491/novozesarol.pdf
    • http://maiquilayaoen.com/uploads/1/3/0/2/130289201/6999061.pdf
    • http://archie-rodriguez.pleasingfood.com/uploads/1/3/0/3/130313529/130313529.html#accp+updates+in+therapeutics+pdf

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001497.bin
731bec16032df94a7a8f0d995f23c0809860f735fe85fad5d0dea08e6e34c9b1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1497 9144 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.