Malicious PDF — malware analysis report

Static analysis result for SHA-256 621924abdf2d0627…

MALICIOUS

PDF

38.0 KB Authoring application: Poppler-utils
MD5: 62c68db9e7867feedf3c56deeb429671 SHA-1: 1c516f4040d7074414f0386b1dfd3e7e41774808 SHA-256: 621924abdf2d0627434ba7f424a260d9ea33c5456c75bfd727866c0c4644a067
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF document is classified as malicious due to its function as a link farm, directing users to numerous external PDF files. The document body, while appearing to offer free books, contains a large number of embedded URLs that likely lead to further malicious content or phishing attempts. The heuristic 'PDF_SEO_LINK_FARM' specifically identifies the mass external PDF link farm as a critical finding.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.enochian.studio/uploads/1/3/0/7/130739750/fojifok-rikexok-zoxisul-taganojowo.pdf
    • http://quotex.fr/uploads/1/3/0/5/130541424/wulibu.pdf
    • http://wendychabot.com/uploads/1/3/0/5/130588345/sifogawa-xapejid.pdf
    • http://mta-sts.mx.clevelandhousepainters.com/uploads/1/3/0/5/130539235/5719127.pdf
    • http://threehappytails.com/uploads/1/3/0/4/130476053/23da0399cd2b7.pdf
    • http://miriamdavies.com/uploads/1/3/0/7/130776031/7235111.pdf
    • http://atozcleaningomaha.com/uploads/1/3/0/8/130874475/53942934c332d.pdf
    • http://tinatan.com/uploads/1/3/0/6/130604045/pukuj.pdf
    • http://bennettallenwood.com/uploads/1/3/0/2/130270879/4fe875a068814.pdf
    • http://treeservicetravelersrest.com/uploads/1/3/0/4/130476505/jugaxisuwefez.pdf
    • http://cryptothermie.com/uploads/1/3/0/4/130488955/1cda8ed44.pdf
    • http://myforum.featherweightaltimeters.com/uploads/1/3/0/6/130621388/pilutag.pdf
    • http://believethepromise.com/uploads/1/3/0/6/130604373/2175b.pdf
    • http://northernrailleaders.com/uploads/1/3/0/7/130740140/5abb5a82.pdf
    • http://michaeladamsauthor.shirehistory.org/uploads/1/3/0/6/130605283/e384df4ae38d0a.pdf
    • http://drchristophermontgomery.com/uploads/1/3/0/4/130435884/6267947.pdf
    • http://bellaandpolly.com/uploads/1/3/0/4/130483819/4ff8b2b33a8fb.pdf
    • http://firstadventuresllc.com/uploads/1/3/0/6/130620952/d615b6cf4b589.pdf
    • http://gracecartercapstone.com/uploads/1/3/0/7/130775407/130775407.html#history+of+english+language+pdf+books+free+download

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000037b0.bin
c36f34a3abc79ad52dc5b3a91bbd310532229cc49f9bd28e5468f63031c158ae		 pdf-font-stream PDF embedded font (sfnt) at offset 0x37B0 7636 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.