Malicious PDF — malware analysis report

Static analysis result for SHA-256 6501b29c63cb1b71…

MALICIOUS

PDF

48.2 KB Authoring application: PDF Studio
MD5: 9852ed20dfd1693237b82a149eb00265 SHA-1: c182e0e973015735e27cb2d454075f68e3059b73 SHA-256: 6501b29c63cb1b71251a22cedf384e9f5e32aea15485517eb3e5d7dd4dc01ab2
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded links to external PDF files hosted on various domains, as indicated by the 'PDF_SEO_LINK_FARM' heuristic. This suggests a tactic to manipulate search engine results or distribute additional malicious content. While no scripts were explicitly extracted, the nature of the embedded links and the ML classification point towards a malicious intent, likely related to phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://poppyandrose.co.uk/uploads/1/3/0/4/130476563/7964322.pdf
    • http://www.paragonhunter.com/uploads/1/3/0/8/130814976/981149.pdf
    • http://comonativo.com/uploads/1/3/0/2/130272905/vigowaso-fanabalote.pdf
    • http://eckelevents.com/uploads/1/3/0/5/130550796/zazagoluzijadop_jazeruri.pdf
    • http://raveconvention.com/uploads/1/3/0/3/130313123/80166.pdf
    • http://koasportsmedia.com/uploads/1/3/0/5/130551488/2d4651b27054e.pdf
    • http://shireoakproductions.com/uploads/1/3/0/6/130639662/5831482.pdf
    • http://stavangerfitness.com/uploads/1/3/0/3/130324027/zudarovoveni_bilom.pdf
    • http://pollielingual.com/uploads/1/3/0/4/130476271/gitukutufis_gakaxalafiki_gukabako_naxidezilef.pdf
    • http://giverciseshorts.com/uploads/1/3/0/7/130775731/fijepadiz.pdf
    • http://hostmaster.mixedpondassociation.org.uk/uploads/1/3/0/6/130604804/masetelukopiloxo.pdf
    • http://mrmcwheely.net/uploads/1/3/0/6/130639093/11e2ddd23bbd6b5.pdf
    • http://casbaad.it/uploads/1/3/0/4/130489465/repot.pdf
    • http://poppyandrose.co.uk/uploads/1/3/0/6/130605015/rutoketefegok-dokakopar-ravulorima-kipizo.pdf
    • http://www.vocationistsuk.co.uk/uploads/1/3/0/4/130476557/5b37fa8.pdf
    • http://masterpeacepress.com/uploads/1/3/0/6/130620966/2329456.pdf
    • http://codingmonkeys.org/uploads/1/3/0/7/130739776/wulekosigogilifuxe.pdf
    • http://ivanprocheret.com/uploads/1/3/0/5/130538836/e00bf.pdf
    • http://micropapillarybreastcancer.org/uploads/1/3/0/4/130436315/kazofobumudawalu.pdf
    • http://ddiamondco.com/uploads/1/3/0/4/130488175/junezusuz-logodur.pdf
    • http://mhwilleke.net/uploads/1/3/0/5/130550665/174bf3b5ce41.pdf
    • http://a1345635xstreamtravel.xsideas.com/uploads/1/3/0/7/130740211/130740211.html#ultrasound+guided+continuous+adductor+canal+block
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000458f.bin
b3affdfdfee497c2d3230853582529cf395d265bfdbb8cde7d84ae9c33602211		 pdf-font-stream PDF embedded font (sfnt) at offset 0x458F 16036 bytes
font_01_sfnt_off00005cab.bin
597b782405da55f63b04d7eac6027bd79719f10358ae66e9c6ba64a3f6b26090		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5CAB 7724 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.