Malicious PDF — malware analysis report

Static analysis result for SHA-256 651f82e5689370fc…

MALICIOUS

PDF

40.4 KB Authoring application: Nitro PDF
MD5: d03f105aa5319c5352728dbad66b1d62 SHA-1: 1ff638532853b6c374357f4c0d672e4ef59ec4b1 SHA-256: 651f82e5689370fcdd5964d924ec065f23de535c98f7f9bd451447755b228bb2
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file was flagged by multiple heuristics, including a critical PDF_SEO_LINK_FARM rule indicating a mass external link farm. The ML classifier also assigned a high probability of maliciousness. The embedded URLs likely lead to further malicious content or phishing attempts, suggesting a phishing or content-distribution attack pattern.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://munciearts.net/uploads/1/3/0/5/130539797/6541827.pdf
    • http://doublelinsulation.com/uploads/1/3/0/5/130588751/nanofikijab-kadora-nugeziw-taponezu.pdf
    • http://myqmunity.com/uploads/1/3/0/5/130589228/vufevuwakoka_fofife_fewez.pdf
    • http://imchuckchoi.com/uploads/1/3/0/2/130273803/8a14e6899a47.pdf
    • http://benlasli.store/uploads/1/3/0/4/130483407/rujuwom.pdf
    • http://shutterupphotography.net/uploads/1/3/0/2/130289480/e8260.pdf
    • http://regenerativemedicalsolution.com/uploads/1/3/0/8/130814179/5012199.pdf
    • http://www.paulemarchand.com/uploads/1/3/0/5/130543386/2ce2d.pdf
    • http://acumobility.com/uploads/1/3/0/3/130379287/dukozenumix.pdf
    • http://jixiangfangzhenrenniuniu.jhamrick.com/uploads/1/3/0/5/130588214/vomotabobimusukupose.pdf
    • http://hellookb.com/uploads/1/3/0/7/130740623/c8b9f87426f2cf.pdf
    • http://jukesbar.net/uploads/1/3/0/4/130475936/7635142.pdf
    • http://teamgls.com/uploads/1/3/0/6/130639622/130639622.html#how+to+flatten+3d+autocad+to+2d
    • http://www.adobe.com/).Noto
    • http://www.google.com/get/noto/http://www.adobe.com/type/This
    • http://scripts.sil.org/OFLNoto

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000332b.bin
7cbae8e04f0c6c262fabf9de85dbc247eb2dc87e126b8bff3724bd13cc1709d9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x332B 9224 bytes
font_01_sfnt_off000050df.bin
afd8868629b61d85ec32a8a0de1ca84da82d48156cdd7447d7c4f51403cf5149		 pdf-font-stream PDF embedded font (sfnt) at offset 0x50DF 5244 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.