Malicious PDF — malware analysis report

Static analysis result for SHA-256 509d6bc46765ac2d…

MALICIOUS

PDF

42.2 KB Authoring application: PDFBox
MD5: 267f26a56f1dc473f0a2b8bfeedaa2a2 SHA-1: 152b2e5ccf14fdc525f248342533576340eacdca SHA-256: 509d6bc46765ac2d089f0787d55cca94d0460b408f4ff25d36ec58a854eb4977
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was flagged by multiple heuristics as malicious, including a critical finding for a link farm containing numerous external PDF links. The ML classifier also assigned a high probability of maliciousness. The primary attack pattern involves directing users to a large number of external PDF files hosted on various domains, likely as a method for phishing or distributing further malware.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://research-usa.com/uploads/1/3/0/7/130775640/gowagitazatubaw_rifib.pdf
    • http://vhhealthcarefun.com/uploads/1/3/0/3/130379115/3207187.pdf
    • http://ltlhotshotforum.net/uploads/1/3/0/7/130776858/70b68312.pdf
    • http://nothinglikeadame.net/uploads/1/3/0/2/130270752/vafusowitoxofenateb.pdf
    • http://111-pod.site/uploads/1/3/0/7/130775197/jozakunonosusada.pdf
    • http://www.gottaluvthatbling.com/uploads/1/3/0/9/130969298/difelerusedov-lijijopagibi-sufigawula-ziduboxoxomapi.pdf
    • http://brainstormembroidery.com/uploads/1/3/0/6/130603955/5335710.pdf
    • http://texassupercool.com/uploads/1/3/0/8/130813030/tasaxawimazix-rivezepibag-rojogoxasipovor-zizumede.pdf
    • http://autodiscover.cakeballsforacause.com/uploads/1/3/0/6/130604192/legomatabufexo_jibavevemexuf_rujukidazebi_vamasiburafo.pdf
    • http://aobassociates.com/uploads/1/3/0/5/130543453/2180418.pdf
    • http://lucernemobilehomepark.com/uploads/1/3/0/2/130289688/denirutosawef.pdf
    • http://southerngracedesigns.com/uploads/1/3/0/2/130291040/f61f3e9137.pdf
    • http://testpages.online/uploads/1/3/0/7/130776791/mulozolowuma-lekoziba.pdf
    • http://vorrax.store/uploads/1/3/0/3/130323750/wusomu.pdf
    • http://quitatlast.com/uploads/1/3/0/4/130488399/gajof.pdf
    • http://mytraining.today/uploads/1/3/0/7/130776341/nirunilezuxutolim.pdf
    • http://xinpujingyulechengruhecunkuan.br3h.com/uploads/1/3/0/5/130545484/130545484.html#asus+rt-ac88u+wireless+ac3100+router+review

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000477f.bin
1afcd64036f1bb5995b164bf1297fe67591eb8447c7ab5ec1c45de109abf329d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x477F 8368 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.