Malicious PDF — malware analysis report

Static analysis result for SHA-256 65065a15e000aa10…

MALICIOUS

PDF

44.5 KB Authoring application: pstoedit
MD5: 5600bc299cf3202157f28f71e2ace228 SHA-1: 4a3ce0a2a6f6ab5594bb3d3429e6bd14f1e2c682 SHA-256: 65065a15e000aa10679c2e0459c6d6b4d57191afda987a6bdd1566181ff0c4d7
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded external links, as detected by the PDF_SEO_LINK_FARM heuristic. The ML classifier and ClamAV also flagged this file as malicious, specifically identifying it as a phishing or traffic-robot distribution method. The embedded URLs likely lead to further malicious content or phishing sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.salonlegal.com/uploads/1/3/0/6/130605156/53257d4a8.pdf
    • http://blueharborproperties.com/uploads/1/3/0/4/130436494/zigitozawesomam_nizuvin.pdf
    • http://brangyconsulting.com/uploads/1/3/0/6/130605162/lolaralojo.pdf
    • http://sydneyvolunteers.com/uploads/1/3/0/6/130603928/rubaboroj.pdf
    • http://asbpw.com/uploads/1/3/0/2/130270826/pemugofojuvixagavilo.pdf
    • http://simplychrischan.com/uploads/1/3/0/2/130289443/xuzipifafik.pdf
    • http://viewmoral.com/uploads/1/3/0/7/130738929/6670834.pdf
    • http://msmsitedesignpreview.com/uploads/1/3/0/7/130776363/1ebe6b88c2fc5.pdf
    • http://ns2.acruiseforyou.net/uploads/1/3/0/6/130639240/kepaka_gigasokogetak_fonapodat_lojamiperomanun.pdf
    • http://kjaneco.com/uploads/1/3/0/8/130814360/dawudumug.pdf
    • http://aharesidents.com/uploads/1/3/0/6/130604581/xutuporidonofeduj.pdf
    • http://mooreanddotman.com/uploads/1/3/0/4/130476310/zoponaxig.pdf
    • http://therealtorsuccessteam.net/uploads/1/3/0/3/130379061/jexagexu-dosotuvujosixow.pdf
    • http://vancouvervideopro.com/uploads/1/3/0/7/130740051/9716942.pdf
    • http://vps11-internal.pleasingfood.com/uploads/1/3/0/4/130476908/130476908.html#symptoms+of+mesenteric+adenitis+in+adults
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003e4e.bin
de9ab7d3f801febf349f8627b7aa0c20fcf05f39190c656d73ff63bae9e1d702		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3E4E 16040 bytes
font_01_sfnt_off00005558.bin
a8f0d33c588678be387cd92b9f3285f1539d803e6b35c0a8c79f6a761262b25a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5558 7508 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.