Malicious PDF — malware analysis report

Static analysis result for SHA-256 665ba2b792d3c212…

MALICIOUS

PDF

37.6 KB Authoring application: Nitro PDF
MD5: ade441033ac7fbd5f63884726144881e SHA-1: 96cc781cf45524042e636d60b768f68f891d746d SHA-256: 665ba2b792d3c21274e3e8c48b27854522bc18dc5c1871eb11228b3538ad07d9
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged by multiple heuristics, including ClamAV and an ML classifier, indicating malicious intent. It contains a large number of embedded URLs pointing to other PDF files, suggesting a link farm or a method to distribute further malicious content. The document body mentions converting HTML to PDF using JavaScript, hinting at potential script execution within the PDF.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.jtimesays.com/uploads/1/3/0/9/130969614/2618797.pdf
    • http://hirevmachineshop.com/uploads/1/3/0/6/130639998/aa4031d1152a002.pdf
    • http://skinskillslab.com/uploads/1/3/0/2/130291485/bosiluzinu-moserezixuwu-nizumi-fizalilusoxiti.pdf
    • http://www.mindfulmoto.us/uploads/1/3/0/7/130738681/ridulefe.pdf
    • http://d-jedi.com/uploads/1/3/0/4/130478602/juzazabotigonabukim.pdf
    • http://deadguyprom.com/uploads/1/3/0/6/130604086/zitasaji.pdf
    • http://x-kaliber.com/uploads/1/3/0/6/130620532/rofavafa.pdf
    • http://lunartico-malamutes.com/uploads/1/3/0/6/130621411/6774705.pdf
    • http://radiochurch.net/uploads/1/3/0/5/130588584/fifawegebis-pokepiva-xoxuvukevutimej.pdf
    • http://thornbrookehomes.com/uploads/1/3/0/6/130605111/zubivilonab.pdf
    • http://highartphoto.net/uploads/1/3/0/7/130739656/zosalijoz.pdf
    • http://admin.calmquietspace.co.uk/uploads/1/3/0/7/130739210/wegevepowa.pdf
    • http://keystonehiphop.com/uploads/1/3/0/2/130272278/sifikefukigi.pdf
    • http://zoeapos.com/uploads/1/3/0/6/130603945/jotike.pdf
    • http://millymop.co.uk/uploads/1/3/0/4/130488503/8338891.pdf
    • http://younglivingdaily.com/uploads/1/3/0/6/130604004/wawux.pdf
    • http://thetrailstownhomes.com/uploads/1/3/0/7/130739827/loguxorera.pdf
    • http://periodic.digital/uploads/1/3/0/5/130590653/c21db.pdf
    • http://mylap-petbed.com/uploads/1/3/0/2/130289611/xujepomul-zuwijetinelorum-wipekan-supusit.pdf
    • http://silvercloudstudios.com.au/uploads/1/3/0/2/130274032/35baa9035930d34.pdf
    • http://blackstonelodgewb.devsite-1.com/uploads/1/3/0/5/130588803/130588803.html#how+to+convert+total+html+page+to+pdf+using+javascript+or+jquery

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003010.bin
c4c6fb2602d97c4236f8648016abdcb3e33501b1dd46e6cae618fd5341e2618c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3010 9060 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.