Malicious PDF — malware analysis report

Static analysis result for SHA-256 68b839b289beb66b…

MALICIOUS

PDF

38.8 KB Authoring application: PDFedit
MD5: 7c2c7c92bf5762741b7d4e0909f3ff13 SHA-1: dcc5778363b9cea321641adf7f8360d3d582b42c SHA-256: 68b839b289beb66b2c45e3e7b997348b9fe2440d63404e892a1ef2e46bf5f787
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links to external PDF files hosted on various domains, indicating a link farm or SEO manipulation tactic. ClamAV and ML classifiers also flagged this file as malicious, specifically identifying it as a phishing attempt. The embedded URLs are the primary indicators of compromise.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://northalabamavinylspecialists.com/uploads/1/3/0/3/130323106/xigojolaf.pdf
    • http://familyfilecardkeeper.com/uploads/1/3/0/9/130969596/bb05eff.pdf
    • http://www.robotbellybutton.com/uploads/1/3/0/7/130775756/8dd133ef.pdf
    • http://purpleboots.net/uploads/1/3/0/7/130739552/31304ab46.pdf
    • http://waiapukidshomebased.com/uploads/1/3/0/5/130589147/7329914.pdf
    • http://www.tempestinateacup.ca/uploads/1/3/0/6/130621626/fitejejir_zaxovelafewuf.pdf
    • http://ibeginwithimagination.com/uploads/1/3/0/7/130776646/likijupeg.pdf
    • http://morrisfamilyfund.org/uploads/1/3/0/7/130738748/f5247e.pdf
    • http://freedomballoonfestival.com/uploads/1/3/0/6/130620624/vogerisaref-lazifipesur-dutisu.pdf
    • http://withwhitandgraceblog.com/uploads/1/3/0/7/130740323/pusepedi-suvajukasupuwe.pdf
    • http://plantationpestservices.net/uploads/1/3/0/2/130271245/meluv.pdf
    • http://newyorkdiamondbling.com/uploads/1/3/0/8/130814553/0b0428fc82b16.pdf
    • http://buoybaby.com/uploads/1/3/0/5/130588478/4319573.pdf
    • http://mockingbird.coffee/uploads/1/3/0/6/130621784/loxug.pdf
    • http://desatascosbadalona.net/uploads/1/3/0/6/130605307/minusubafumimipakiti.pdf
    • http://northtexasdoodles.com/uploads/1/3/0/6/130639479/xegaxanipizupig_zefono_josek.pdf
    • http://makethedollar.com/uploads/1/3/0/2/130270936/muberuruwil.pdf
    • http://internationaldunnage-us.net/uploads/1/3/0/6/130621815/9064694.pdf
    • http://owr.world/uploads/1/3/0/6/130639221/tiwufivi.pdf
    • http://celebrateadoptioncincinnati.org/uploads/1/3/0/5/130551745/kudejupimokud.pdf
    • http://74-123-77-80.mgwnet.com/uploads/1/3/0/6/130605476/130605476.html#alliteration+in+children%27s+poetry

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000036f2.bin
ad54c4c04a7e86cd72b0b8efad11f7e28ccc09bc45a8bcbf506b4f3225c02d36		 pdf-font-stream PDF embedded font (sfnt) at offset 0x36F2 8236 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.