Malicious PDF — malware analysis report

Static analysis result for SHA-256 64443b852b55dc32…

MALICIOUS

PDF

57.9 KB Authoring application: Soda PDF
MD5: 08a841362d102e4ef22d6d865582b26a SHA-1: 3b76637c18187573df04a8e1034cde7d078270ab SHA-256: 64443b852b55dc328f348dd92483152ef9caff5cb63eb28a725b384f917c79ce
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded external links, as detected by the PDF_SEO_LINK_FARM heuristic. These links point to various domains, each hosting a PDF file, suggesting a coordinated effort to manipulate search engine results or distribute malicious content. The ML_NYX_PDF_MALICIOUS and ClamAV detections further confirm the malicious nature of the file.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://rockymountainweddingflute.com/uploads/1/3/0/3/130379625/subuza.pdf
    • http://umotivemove.com/uploads/1/3/0/4/130483087/8516139.pdf
    • http://deepspringdistillery.com/uploads/1/3/0/5/130539311/8033044.pdf
    • http://trustedadvocates.org/uploads/1/3/0/6/130620607/12052f0.pdf
    • http://salaharabians.com.au/uploads/1/3/0/6/130620370/tibuvekazut.pdf
    • http://lvhalo.com/uploads/1/3/0/6/130639886/samadilekelori_rogib_pagubo.pdf
    • http://yunisquare.com/uploads/1/3/0/5/130551116/5618174.pdf
    • http://sjonathanphilip.com/uploads/1/3/0/5/130550841/7616601.pdf
    • http://nicole-florio.com/uploads/1/3/0/3/130313053/3418388.pdf
    • http://lhbs.org/uploads/1/3/0/6/130639123/jawegejenoluso.pdf
    • http://oddcatsanctuary.com/uploads/1/3/0/6/130620708/zadunawil.pdf
    • http://dmnroundtable.com/uploads/1/3/0/4/130478819/tajaxodaz_rajiwodidonub_vuvamagotegiti.pdf
    • http://ez3.brdge.org/uploads/1/3/0/8/130814056/130814056.html#left+de+quervain%27s+tendonitis+icd+10
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License
    • https://fedoraproject.org/wiki/Licensing/LiberationFontLicense

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006695.bin
189cfc6ae6c9026fcb797ee9bb8d989677d0e6fd1d389b5973aab54795eeda44		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6695 16556 bytes
font_01_sfnt_off00007ce7.bin
d907c570f1f8f2d62f38d7529dbf77de46ca3a1917ec53aca7a78bae59874b04		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7CE7 2616 bytes
font_02_sfnt_off00008907.bin
e060af30ed2fde529958a84d120aef430b7c99efd7d9d061c60445e95201a231		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8907 9216 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.