Malicious PDF — malware analysis report

Static analysis result for SHA-256 54ad50a3f5e04cbf…

MALICIOUS

PDF

80.4 KB Authoring application: GIMP
MD5: a5d7b90f6ba98ee9c77a4293690d28f0 SHA-1: 95a977f96ca14b81be9cfa71f024d1b3c6c71671 SHA-256: 54ad50a3f5e04cbf4a0e38e6ecb846c33515ab26f5120765ff69f93738417a05
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded URLs pointing to external PDF files, a technique often used for SEO manipulation or to distribute malicious content. The ClamAV detection and ML classifier strongly indicate malicious intent. The heuristic 'PDF_SEO_LINK_FARM' specifically identifies the mass external PDF link farm as a critical finding, with the dominant host being 'nikkirelford.com'. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://nikkirelford.com/uploads/1/3/0/6/130639296/fisomoxupuso.pdf
    • http://jennysdivinedelights.com/uploads/1/3/0/9/130969761/mabaduvijaxowun.pdf
    • http://www.cologenskin.co.uk/uploads/1/3/0/7/130776411/wanejedibowuv_goremarobe.pdf
    • http://hackspokane.com/uploads/1/3/0/5/130589286/pawafuroxov.pdf
    • http://landingmarket.net/uploads/1/3/0/4/130483558/nitumejila.pdf
    • http://missteendreamusa.com/uploads/1/3/0/2/130289767/8299964.pdf
    • http://strategicpropertydesign.com/uploads/1/3/0/2/130271171/seduf.pdf
    • http://www.toys4ucy.com/uploads/1/3/0/5/130589268/5939362.pdf
    • http://shutterkitten.com/uploads/1/3/0/9/130969386/1295788.pdf
    • http://www.iamthedelta.org/uploads/1/3/0/4/130488832/fdbe6428437a61f.pdf
    • http://farukkanca.com/uploads/1/3/0/2/130287257/3362986.pdf
    • http://arkansasartpottery.com/uploads/1/3/0/5/130589208/df51973b678.pdf
    • http://greatguys.org/uploads/1/3/0/5/130551059/7269848.pdf
    • http://oclacrosse.net/uploads/1/3/0/6/130604213/dogez.pdf
    • http://www.adriennemarellano.com/uploads/1/3/0/8/130874287/3934385.pdf
    • http://passyunksquare.net/uploads/1/3/0/4/130436483/b9fe0c56.pdf
    • http://beachypress.com/uploads/1/3/0/7/130775742/xivosa-puvawovatawat.pdf
    • http://customaluminumreels.com/uploads/1/3/0/8/130874610/8206582.pdf
    • http://texaspoolremodel.com/uploads/1/3/0/9/130969659/7298691.pdf
    • http://calmongoods.com/uploads/1/3/0/5/130588554/guzirenexa_feloxotimu.pdf
    • http://artinheavenhellonearth.com/uploads/1/3/0/4/130476816/juzateremiv-kuwule-vafowuzanu-nufiki.pdf
    • http://s5xpv.bpmtc.com/uploads/1/3/0/6/130604303/130604303.html#penanganan+anemia+sedang+pada+ibu+hamil

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003e12.bin
f689831a78fdc75a09928fee1cdc91396d006636b118bdc9cd58e9fd6488ec20		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3E12 16136 bytes
font_01_sfnt_off000055e8.bin
396e85711ed0b46f021e0d00ba38bd6403b7ef462e5bdf6694a57b2ede448e10		 pdf-font-stream PDF embedded font (sfnt) at offset 0x55E8 8244 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.