Malicious PDF — malware analysis report

Static analysis result for SHA-256 5aeaf97be6b6fc57…

MALICIOUS

PDF

84.2 KB Authoring application: PDFedit
MD5: 5172d6c4ab1266cfd05ced102d69e432 SHA-1: 168efdb3e4c8d30e7cf87868cb9b8b3195e5aae0 SHA-256: 5aeaf97be6b6fc578fd57f3aec5bd0509bbe26e27d499a76eb33308159eed118
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. The ClamAV detection and ML classifier also indicate maliciousness. While no scripts were explicitly extracted, the embedded URL action suggests the PDF is designed to redirect users to a network of other PDF files, likely for SEO spam or to host further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://themazeon23rd.com/uploads/1/3/0/6/130639963/6393299.pdf
    • http://soque.net/uploads/1/3/0/3/130313088/27f8bd14923.pdf
    • http://vancityfurniture.com/uploads/1/3/0/4/130435594/9627974.pdf
    • http://www.misylmalove4oneanotherfoundation.com/uploads/1/3/0/6/130605015/138281b10ed.pdf
    • http://mta-sts.starzsalon.com/uploads/1/3/0/6/130604101/9206181.pdf
    • http://mvstuff.com/uploads/1/3/0/6/130640116/2497125.pdf
    • http://vegas-magic.com/uploads/1/3/0/8/130874286/bec4933107a.pdf
    • http://mx.wepnerwellness.com/uploads/1/3/0/9/130969172/jidogikiwalo.pdf
    • http://stand2serve.net/uploads/1/3/0/6/130604803/wobiduti.pdf
    • http://repiping.net/uploads/1/3/0/6/130639875/bevejalikinasilolos.pdf
    • http://nomnomnatural.com.au/uploads/1/3/0/5/130546283/xipit.pdf
    • http://www.myteamnavigate.com/uploads/1/3/0/8/130814298/munerob.pdf
    • http://thewanderingtourist.com/uploads/1/3/0/6/130604049/c02c5b5.pdf
    • http://thetribe.club/uploads/1/3/0/6/130621487/2763487.pdf
    • http://rollingoaksmemorialcenter.net/uploads/1/3/0/7/130739557/bc92cbcec809.pdf
    • http://withoutwaste.net/uploads/1/3/0/4/130488891/pasapug.pdf
    • http://www.devonopera.com/uploads/1/3/0/3/130324350/pilazarakemezakopedo.pdf
    • http://acerecoverygroup.com/uploads/1/3/0/5/130543054/5f8646e.pdf
    • http://nabhthefam.com/uploads/1/3/0/2/130291579/fafazudakagunenava.pdf
    • http://graycloudsofdeath.com/uploads/1/3/0/4/130488700/32655f28d693d2c.pdf
    • http://villagekeepersofbaltimore.com/uploads/1/3/0/3/130323412/b61cb1d6ace1d.pdf
    • http://newbeginningsinvestorsllc.com/uploads/1/3/0/2/130289652/toresikobemupa_supam_fajagutu.pdf
    • http://cofrefinanciero.com/uploads/1/3/0/5/130588687/5818993.pdf
    • http://tortugamobile.com/uploads/1/3/0/6/130604294/81fab4b1a5702ea.pdf
    • http://mealofthemonthclub.com/uploads/1/3/0/6/130639963/zomazubipirodifewopa.pdf
    • http://adsl-65-43-110-210.carmichaelnl.com/uploads/1/3/0/6/130639904/130639904.html#ielts+writing+task+2+topics+with+answers+download

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001154.bin
10d868aefa44b0ba54da8518da14d526bc0f0c46b8ffca1ec1ddc721a65d35d4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1154 8164 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.