Malicious PDF — malware analysis report

Static analysis result for SHA-256 63a68e48cbedbdbb…

MALICIOUS

PDF

46.6 KB Authoring application: pstoedit
MD5: fbf921a1bb51624a36524b3c8dea6190 SHA-1: 1bd054f277a7daa199b659267fef3f0676b1282c SHA-256: 63a68e48cbedbdbb280c1225141059ef413ac5eca0f2f6de87e16141ab7785ef
160 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a mass of embedded URLs disguised as book download links, a common tactic for phishing or malware distribution. The ClamAV detection and ML classifier strongly indicate malicious intent, likely related to distributing further malicious content via the numerous linked PDFs. No scripts were extracted, but the structure suggests a link farm designed to host or redirect to malicious payloads.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcommnc.com/uploads/1/3/0/6/130622032/3435746.pdf
    • http://rollershadeiq.com/uploads/1/3/0/4/130483184/8877298.pdf
    • http://robinson-david.com/uploads/1/3/0/5/130539516/kubinigedafosep_gajezufozabasaz.pdf
    • http://impeachtrump.org/uploads/1/3/0/6/130639721/vifesuzavadop-jivabaler-tofamosoxegeru-xefabixetukijaz.pdf
    • http://intellidocs.net/uploads/1/3/0/2/130288552/malonifokum-kajaje-bapozemudivas-xujelov.pdf
    • http://azzurrawebart.com/uploads/1/3/0/4/130483753/gowewowinas.pdf
    • http://thestitchroom.com/uploads/1/3/0/5/130539319/wugivisutifiz-nezuku-xurodol-memof.pdf
    • http://canyoupark.com/uploads/1/3/0/2/130287296/borif-nepoduj.pdf
    • http://happycamperllc.com/uploads/1/3/0/4/130483489/92bf14c.pdf
    • http://nicolehamilton.com.au/uploads/1/3/0/5/130541140/7f67c198f.pdf
    • http://7magicflower.com/uploads/1/3/0/6/130621456/2887587.pdf
    • http://need4relief.com/uploads/1/3/0/4/130476795/tidutom.pdf
    • http://acouturelife.com/uploads/1/3/0/7/130775961/130775961.html#new+headway+elementary+english+course+student%27s+book+pdf+free+download
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000013a4.bin
519384b71fe958f325661ad181edaaa0ef4363fc3917959a8db9467452d9190c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13A4 7860 bytes
font_01_sfnt_off000069b7.bin
370b2be331aff6d236d9fa2a722ca60397ea47f1391cd4f84a43bee1b2780512		 pdf-font-stream PDF embedded font (sfnt) at offset 0x69B7 17888 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.