Malicious PDF — malware analysis report

Static analysis result for SHA-256 503ca61dd6c14486…

MALICIOUS

PDF

45.3 KB Authoring application: pdf-parser
MD5: bef22644bd682fe92f1ada0451e01456 SHA-1: 8e70cf0f7a1617e14451a6e9a9c10846c764ab3e SHA-256: 503ca61dd6c14486aa3d167c4cc28b2d473baaced784ba3318bf34059c14088c
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF contains a large number of external links, many pointing to PDFs hosted on compromised websites, as indicated by the PDF_SEO_LINK_FARM heuristic. The ML classifier and ClamAV detection strongly suggest malicious intent, specifically identified as phishing or a traffic redirection robot. The embedded URLs likely serve as a lure to download further malicious content or to phish user credentials.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://nelsonfarmersmarket.org/uploads/1/3/0/4/130489230/pifora.pdf
    • http://heartforwomenministries.com/uploads/1/3/0/7/130776239/2559453.pdf
    • http://apiarydesigns.com/uploads/1/3/0/5/130589108/8071185.pdf
    • http://www.obakosobotanica.org/uploads/1/3/0/7/130775154/jakafefamupokuvagux.pdf
    • http://maggiesmithcounselling.com/uploads/1/3/0/4/130488196/samexejalopudidoza.pdf
    • http://iinkedmakeup.com/uploads/1/3/0/6/130604986/2b775f3d2ec9.pdf
    • http://ceosleepouttoronto.org/uploads/1/3/0/6/130639745/9356315.pdf
    • http://uservite.com/uploads/1/3/0/7/130739591/6919665.pdf
    • http://growtolearnnyc.org/uploads/1/3/0/5/130541073/futuzupuzik.pdf
    • http://lucky13lawncare.com/uploads/1/3/0/6/130620557/nepamuzos-zebupeder-bakozujasu-jizuk.pdf
    • http://kauffmancenterstore.org/uploads/1/3/0/7/130740617/vinijijakosamox_lidafi.pdf
    • http://heavensentlawnmanicurist.net/uploads/1/3/0/6/130639298/130639298.html#acute+renal+failure+nursing+management

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000594c.bin
1e590390145b98f02b144f2ea5072a5ae72c7a849ed0a7bd81d679c4ce166e9d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x594C 8520 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.