Malicious PDF — malware analysis report

Static analysis result for SHA-256 5df6b36306ac086e…

MALICIOUS

PDF

34.3 KB Authoring application: pstoedit
MD5: 30d52f62de768f8c217b2c2f48f0ee0a SHA-1: ea1d555fe4fa39e4ae2a0ecea7416cf2280e1065 SHA-256: 5df6b36306ac086e96623c28e13728b6e790ea9e4df91fac1a189fcfff90abd5
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of external links, identified as a link farm, suggesting a phishing or spamming campaign. The document body attempts to trick the user into believing they are using an outdated browser, likely to encourage the download of a malicious payload. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports the phishing and malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://westerncanadasolar.com/uploads/1/3/0/5/130540559/2129252.pdf
    • http://worldcultureguide.org/uploads/1/3/0/6/130621378/b2c302abf0c8.pdf
    • http://www.drjob.be/uploads/1/3/0/2/130272396/joletuze_gomasawariwigik_nupuzibomi_pupunepogax.pdf
    • http://guadasauce.com/uploads/1/3/0/8/130813372/tepitotudexuzozonif.pdf
    • http://asasvc.com/uploads/1/3/0/5/130543063/3162642.pdf
    • http://adidasdeadstockmarketplace.com/uploads/1/3/0/6/130621502/4835859.pdf
    • http://dynamicsymmetryart.com/uploads/1/3/0/6/130639267/80a54b.pdf
    • http://tudientot.com/uploads/1/3/0/3/130312983/4411368.pdf
    • http://bigdataclass.com/uploads/1/3/0/5/130590608/5577151.pdf
    • http://chopshopsaladshop.com/uploads/1/3/0/7/130740222/wekifonana.pdf
    • http://nmwild.com/uploads/1/3/0/7/130776535/5297029.pdf
    • http://experiencetrafalgar.com/uploads/1/3/0/3/130313289/zasalojatogow_litelubugu_depulozimokan.pdf
    • http://wcd-mx98whfv.mgh-r.ch/uploads/1/3/0/6/130639980/130639980.html#second+language+acquisition+research+paper

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002e6f.bin
38d50dc6e3793a9c67492eceb7710edbbca477f1c2f53ff4b8a9c441393076a1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2E6F 7800 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.