Malicious PDF — malware analysis report

Static analysis result for SHA-256 50c6f8c42d46b5ea…

MALICIOUS

PDF

50.6 KB Authoring application: pstoedit
MD5: d18a6b157474483fab7a6d09bb6a17a6 SHA-1: ace760771de285381213d8a0038076e710f50780 SHA-256: 50c6f8c42d46b5ea036e3d46884a653affd6b3ff340bc8b3bb2325b3ac69e155
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic, suggesting a link farm or redirection scheme. ClamAV detection as Pdf.Phishing.TtraffRobotInstall-7605656-0 further supports a phishing or traffic-generating intent. The embedded URLs are likely used to distribute malicious content or lead users to phishing pages.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://futsal415.net/uploads/1/3/0/8/130874567/duxaril-sovutodajodeti.pdf
    • http://www.onsolvecoptampa.com/uploads/1/3/0/8/130874287/losebunanem_jozajiteruzobeg.pdf
    • http://robsvirtualretirement.com/uploads/1/3/0/4/130488736/babejakamojod.pdf
    • http://00964.net/uploads/1/3/0/3/130313471/tifuwetutine.pdf
    • http://limitlesspeggy.com/uploads/1/3/0/7/130775498/35f2e5483eaf58.pdf
    • http://bluegillmarketing.net/uploads/1/3/0/8/130814402/zoziseva.pdf
    • http://instaadz.com/uploads/1/3/0/7/130775220/471d909fa6d55a.pdf
    • http://beesea.com/uploads/1/3/0/6/130605390/zotumikabadebi_wunes_govefow.pdf
    • http://partocica.com/uploads/1/3/0/2/130271167/6253015.pdf
    • http://kidstipi.com/uploads/1/3/0/2/130273798/luremujufebuvem.pdf
    • http://www.dtpvt.com/uploads/1/3/0/5/130538891/3093748.pdf
    • http://theludditepress.com/uploads/1/3/0/4/130483050/fewezanarusilule.pdf
    • http://msmurphyschemistry.com/uploads/1/3/0/2/130289265/435880c21.pdf
    • http://soloporque.org/uploads/1/3/0/3/130323817/nebiga_tezesid_bumibasiv_tetinejijinemek.pdf
    • http://dungeonplace.com/uploads/1/3/0/6/130639854/f22d90393440.pdf
    • http://openguardsweeps.com/uploads/1/3/0/4/130483836/widenapikewum-lagada.pdf
    • http://heeratees.com/uploads/1/3/0/5/130539757/xoratuwugapuxavoris.pdf
    • http://farmboy.press/uploads/1/3/0/4/130436218/f638bfdb76fc.pdf
    • http://chiavantage.com/uploads/1/3/0/7/130775990/7491386.pdf
    • http://thesoonernetwork.com/uploads/1/3/0/6/130604518/130604518.html#adenovirus+que+son

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000044bd.bin
b8f82a1b5e77b1f042d7f3f3804003d26a7fa42fbc560131941f20f3cdd8abcd		 pdf-font-stream PDF embedded font (sfnt) at offset 0x44BD 2944 bytes
font_01_sfnt_off00004e79.bin
779aa567746046747dac965df7fdfb06ff632674a0a99ce247a327bf89f0fa63		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4E79 16036 bytes
font_02_sfnt_off0000660e.bin
50de35a9b5ec36899010d52958352a8d59f990849ccfba0fe9ece7e931eddb1a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x660E 8920 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.