Malicious PDF — malware analysis report

Static analysis result for SHA-256 518eb4bfd5be29e5…

MALICIOUS

PDF

40.3 KB Authoring application: pstoedit
MD5: dc0705d021b0293e465697549e4fa359 SHA-1: 768d0da7114b719e4ced905049d8850b02127a0f SHA-256: 518eb4bfd5be29e56dff1b118a48e258cfe565349209be1c47726d8d849d5f40
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious File

The PDF file was flagged by multiple heuristics, including a critical alert for a link farm and ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0'. The document body contains numerous embedded URLs pointing to other PDF files, suggesting a phishing or malicious content distribution scheme. The primary purpose appears to be directing users to external, potentially malicious, PDF documents.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://nevermetapodcast.com/uploads/1/3/0/7/130775451/kodujipux-serip-dixazetuxivus.pdf
    • http://hotelnauvoo.us/uploads/1/3/0/6/130621531/faf82693622a.pdf
    • http://der-atemraum.com/uploads/1/3/0/7/130776114/6816350.pdf
    • http://quikartist.com/uploads/1/3/0/7/130776385/6945910.pdf
    • http://color-paper.com/uploads/1/3/0/6/130620390/1099262.pdf
    • http://twofacesonefist.com/uploads/1/3/0/3/130313306/jexegipizaxoroleke.pdf
    • http://laknainc.net/uploads/1/3/0/2/130289294/lafozitafinen_zogupuxa.pdf
    • http://u21.life/uploads/1/3/0/8/130813429/vamipobude.pdf
    • http://masterrepairplumbing.org/uploads/1/3/0/3/130313054/zeripadase_roroxutanigun_gimapilu.pdf
    • http://belatik.store/uploads/1/3/0/5/130541131/woxazijaronupuvepo.pdf
    • http://soyproactivo.com/uploads/1/3/0/2/130272284/3803168.pdf
    • http://moretonislandfishingcharters.com/uploads/1/3/0/4/130490808/b1c7155de.pdf
    • http://carolynwiese.com/uploads/1/3/0/4/130483350/3435093.pdf
    • http://oceanassassin.com/uploads/1/3/0/4/130483552/bakepuwor.pdf
    • http://www.aisthetik.com/uploads/1/3/0/7/130739751/tugewuxetujet.pdf
    • http://toysiberianhuskies.com/uploads/1/3/0/6/130604492/pixevatodafen-pefoxi-madumozo.pdf
    • http://lilyfairgifts.com/uploads/1/3/0/6/130639643/198a245d.pdf
    • http://www.costawear.store/uploads/1/3/0/3/130379121/vakimanowexot.pdf
    • http://www.growingbolderfitness.com/uploads/1/3/0/4/130488398/1374953.pdf
    • http://michaelgrew.net/uploads/1/3/0/3/130323291/tuwomivalutagiw-fifukisevi.pdf
    • http://kimgustafson.net/uploads/1/3/0/5/130588363/juralewuvemadib-pawepiv-butave-toxaki.pdf
    • http://momandpopeshop.com/uploads/1/3/0/6/130639180/da3c094e26dc8ea.pdf
    • http://www.truebestself.com/uploads/1/3/0/7/130739330/130739330.html#propidium+iodide+cell+cycle+analysis+kit

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000038e7.bin
0b873c2f5b0a0956ffc8164d3e4b61ec1e970a8f1fd4864f944b46e58b5b6290		 pdf-font-stream PDF embedded font (sfnt) at offset 0x38E7 9084 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.