Malicious PDF — malware analysis report

Static analysis result for SHA-256 686a76e9b8a43eda…

MALICIOUS

PDF

44.2 KB Authoring application: PDFedit
MD5: 564d0fa23a4de43d2df4a2aba5f65b10 SHA-1: c88ee8ad1eada4ee3cbbfc12870939eafa59f8c4 SHA-256: 686a76e9b8a43eda476659bc3a96834a566364b02505761157af8858c11df719
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded URLs pointing to other PDF files across various domains, as indicated by the PDF_SEO_LINK_FARM heuristic. This suggests a tactic to manipulate search engine results or distribute a payload through a link farm. The ML classifier and ClamAV detection further support its malicious nature, classifying it as phishing-related.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cattlecorp.net/uploads/1/3/0/5/130588349/gowibegojuno.pdf
    • http://movetocharlottecounty.com/uploads/1/3/0/2/130291536/38bc6.pdf
    • http://refugeenterprise.com/uploads/1/3/0/6/130604140/fozikunetowuwigimebi.pdf
    • http://hellosimplicity.com/uploads/1/3/0/5/130550652/7947351.pdf
    • http://plentyoffish-helpcenter.services/uploads/1/3/0/7/130739564/b64ddab13b3b44f.pdf
    • http://www.oliviaripps.com/uploads/1/3/0/3/130323374/3050946.pdf
    • http://inqeparo.com/uploads/1/3/0/7/130775632/nunewol-refovizubaru.pdf
    • http://streamlinenation.net/uploads/1/3/0/7/130740051/fusadibikapek_mixazigixi_kifuwa.pdf
    • http://rose-from-concrete.com/uploads/1/3/0/5/130588517/kikelafanej_fefag.pdf
    • http://ribbonspaperscissors.com/uploads/1/3/0/2/130289632/72c3ce965596.pdf
    • http://www.junebennett.net/uploads/1/3/0/7/130738541/695ad1320e035a5.pdf
    • http://robinjoyphotography.net/uploads/1/3/0/5/130589315/1982524.pdf
    • http://flyandtrendy.shop/uploads/1/3/0/5/130539042/d8da2ef6.pdf
    • http://watlingst.com/uploads/1/3/0/7/130738892/1539749.pdf
    • http://irrationalthinking.net/uploads/1/3/0/4/130483634/dukivop_kiwik_pupivuluf.pdf
    • http://roseandfifth.com/uploads/1/3/0/5/130545382/zukug.pdf
    • http://supremespeech.com/uploads/1/3/0/7/130739280/c041382d8ef.pdf
    • http://makingmemorieswithscrapbooking.com/uploads/1/3/0/5/130590224/jobonufo.pdf
    • http://globalbiomedscientific.com/uploads/1/3/0/3/130323616/genatat_budilujof_jurevu.pdf
    • http://connectarte.com/uploads/1/3/0/7/130775741/lubuliwamogetenav.pdf
    • http://nhvtencampment.nhcapcadets.org/uploads/1/3/0/5/130540366/c4df243d2c2cc.pdf
    • http://sharedpl.com/uploads/1/3/0/8/130874672/3e6e54e3fc4b85.pdf
    • http://mindtoys.net/uploads/1/3/0/6/130604631/8f9c60ad698165.pdf
    • http://xt2i7j.bdgct.com/uploads/1/3/0/5/130550857/130550857.html#basketball+shooting+drills+for+5th+graders
    • http://ogino-mpe-lab.dana-farber.org/uploads/1/3/0/4/130436172/fimubaj_zuzegegamutoga_peton.pdf

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004a5c.bin
28ea4fe1766456fca46b614fad05bd0f33bf57e1e74cc9fc8a19c679c697c0d7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4A5C 7784 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.