Malicious PDF — malware analysis report

Static analysis result for SHA-256 56c0099615af1df6…

MALICIOUS

PDF

40.8 KB Authoring application: ImageMagick
MD5: c6ea6cbc877cd2b426777933a4a24a60 SHA-1: 1509696842ffa9eab05a01da47ac40895f6529da SHA-256: 56c0099615af1df6b5b488212f740af074854b5a81514a4b743e68fcde5967cd
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links to external PDF files hosted on various domains. This behavior is indicative of SEO spam or a phishing campaign designed to drive traffic to malicious or low-reputation sites. The ClamAV detection and ML classifier further support the malicious nature of this file.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.mysticnavigator.com/uploads/1/3/0/2/130271201/3639934.pdf
    • http://newdawnresidential.com/uploads/1/3/0/2/130272513/13656161f00321c.pdf
    • http://myrealadvantage.com/uploads/1/3/0/5/130588473/7318143.pdf
    • http://sweetpeasdreamzzz.com/uploads/1/3/0/6/130604626/lifadiwojaxex.pdf
    • http://www.ttmusb.com/uploads/1/3/0/2/130292148/6423976.pdf
    • http://sportykids.se/uploads/1/3/0/5/130543369/4447427.pdf
    • http://mnixonsclassroom.com/uploads/1/3/0/4/130488244/rikojom.pdf
    • http://nerdvil.com/uploads/1/3/0/7/130740537/eb6366.pdf
    • http://www.vpivips.com/uploads/1/3/0/3/130312916/jevitez.pdf
    • http://metalroofexpertwitness.com/uploads/1/3/0/7/130739835/sexilegamox.pdf
    • http://www.kirkcudbrightkennels.com/uploads/1/3/0/5/130539048/nudetub.pdf
    • http://mytxreal.net/uploads/1/3/0/5/130590463/wikunanewazowe_tapegidis_vezinaduvu.pdf
    • http://elephanteater.org/uploads/1/3/0/4/130478067/zugavaf_fobiduwiti_sububajuwomuni_pizosirafojof.pdf
    • http://codemonster.com/uploads/1/3/0/4/130476161/zunatabod.pdf
    • http://alisonhmayer.com/uploads/1/3/0/5/130542937/dafekidewofuzaz.pdf
    • http://www.superiorcasecodingblogging.com/uploads/1/3/0/5/130550797/reradulenalebobo.pdf
    • http://budgetrollershutters.net/uploads/1/3/0/5/130588502/tasododa.pdf
    • http://tomkeifer.net/uploads/1/3/0/5/130550953/6691278.pdf
    • http://davidmarwick.com/uploads/1/3/0/6/130604306/3497621.pdf
    • http://kelseyleonofficial.com/uploads/1/3/0/6/130604935/3445364.pdf
    • http://cpanel.lisaorrart.com/uploads/1/3/0/2/130288402/9791025.pdf
    • http://igamma-group.com/uploads/1/3/0/5/130590698/2819143.pdf
    • http://web6.pleasingfood.com/uploads/1/3/0/5/130589401/130589401.html#safe+exercises+for+bulging+cervical+disc

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003fc9.bin
3820edc08c84db4e17e3f102678d745fd73bbdea91e951d71499bc8d3f40bd87		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3FC9 7424 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.