Malicious PDF — malware analysis report

Static analysis result for SHA-256 50d94e3888d12776…

MALICIOUS

PDF

113.9 KB Authoring application: Adobe PDF Library 9.0
MD5: 0c4e92ad6f6d9c4f9048d259d7dfea16 SHA-1: c49944757c9fb44e00230a5afe6efb9eb32137a3 SHA-256: 50d94e3888d1277670d6b20a370dad7598a4f78981c26a4921aa2ee5af16538e
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links to other PDF files hosted on various domains. This behavior is indicative of a link farm or a distribution mechanism for further malicious content, as flagged by the PDF_SEO_LINK_FARM heuristic. The ML classifier and ClamAV detection strongly support the malicious nature of this file. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://diamondviewfarms.com/uploads/1/3/0/5/130550915/xuzejalel.pdf
    • http://mogizmo.com/uploads/1/3/0/5/130588833/gufasep.pdf
    • http://novamotorshaiti.com/uploads/1/3/0/7/130739332/7206509.pdf
    • http://rancho-oaks-gs.org/uploads/1/3/0/6/130604025/3772628.pdf
    • http://austinaction.com/uploads/1/3/0/8/130813750/milatojijizawure.pdf
    • http://miamirehearsal.com/uploads/1/3/0/7/130739341/ac4e4.pdf
    • http://localseonyc.net/uploads/1/3/0/2/130289589/lodanameb.pdf
    • http://startingpoint.info/uploads/1/3/0/2/130287737/fiwuzojeke_mologagira.pdf
    • http://tahitianvillageapartments.com/uploads/1/3/0/5/130590138/734754.pdf
    • http://coalhillminingcompany.com/uploads/1/3/0/5/130539738/soragigewoteseb.pdf
    • http://missfitonline.com/uploads/1/3/0/6/130640235/jokedebizoruz.pdf
    • http://dragoonitcn.net/uploads/1/3/0/4/130483350/afcaecd.pdf
    • http://chichippieproductions.net/uploads/1/3/0/7/130776699/zumeluwunavorimovas.pdf
    • http://mshannahfreeman.com/uploads/1/3/0/5/130589373/purerururifitikufil.pdf
    • http://aprginc.com/uploads/1/3/0/6/130621228/7195981aa.pdf
    • http://texasbackhaul.com/uploads/1/3/0/7/130776747/kuzumonenafeb_dinotinevogogo.pdf
    • http://thomastrevino.com/uploads/1/3/0/5/130539820/zisupatuzan.pdf
    • http://host48.carmichaelnl.com/uploads/1/3/0/7/130738784/130738784.html#markov+chains+real+world+applications

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001152.bin
21faae399616d31bcd391965092b78ef00fcd7669cecc5bfd64fa60730260085		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1152 10768 bytes
font_01_sfnt_off0000a92d.bin
319f6c37f3e2510f8a56807de158a15871cf96916716f714b2d215d6e2e9f16c		 pdf-font-stream PDF embedded font (sfnt) at offset 0xA92D 16752 bytes
font_02_sfnt_off00018202.bin
cb2f6860dcbe91e7dcb4c253278a6f893f527b858cd800b2912f5b7bc9c3c0a1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x18202 4548 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.