Malicious PDF — malware analysis report

Static analysis result for SHA-256 695f3e02666dcbdc…

MALICIOUS

PDF

43.1 KB Authoring application: Soda PDF
MD5: 31e5a51f35838922e9e451926f47b23a SHA-1: 9c27519db01f5b84e0af5cbffd942310eb9326ec SHA-256: 695f3e02666dcbdc6481abc75fe57dd218b90a6be01bab107c149fd31c2a2097
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded URLs, identified by the PDF_SEO_LINK_FARM heuristic, suggesting a link farm or redirection to malicious content. The ML classifier and ClamAV detection strongly indicate malicious intent, likely related to phishing or malware distribution via these links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://mgbbsewing.com/uploads/1/3/0/4/130476372/latesatuviwuraf_soxukavudozom_bajavu_mekiwewolaxov.pdf
    • http://highlight.pl/uploads/1/3/0/4/130436093/8890388.pdf
    • http://mta-sts.palmerstons.co.uk/uploads/1/3/0/3/130323765/puzarow_salemune_wakenirawebod_xejine.pdf
    • http://beautifulpinkk.com/uploads/1/3/0/2/130289163/jigokaf.pdf
    • http://truedefdentallaboratory.com/uploads/1/3/0/7/130775505/1569236.pdf
    • http://mnbatigers.net/uploads/1/3/0/7/130775934/6651312.pdf
    • http://bandyphotos.com/uploads/1/3/0/6/130621809/2917924.pdf
    • http://sparkfactory.co.uk/uploads/1/3/0/3/130323213/vufevoxazopufur.pdf
    • http://noelguidry.com/uploads/1/3/0/5/130545249/1380431.pdf
    • http://mytajfashionincorporated.com/uploads/1/3/0/6/130639849/tupebulo.pdf
    • http://kobyg.com/uploads/1/3/0/5/130590477/9366517.pdf
    • http://drjeffbarone.com/uploads/1/3/0/5/130588315/d32485bf8b.pdf
    • http://casualshifts.com/uploads/1/3/0/2/130273893/5237400.pdf
    • http://intraterrestrial.net/uploads/1/3/0/2/130289243/1333442.pdf
    • http://tomwenfashiondesign.com/uploads/1/3/0/6/130639708/75498cbeb4dc48b.pdf
    • http://meetthebeetles.info/uploads/1/3/0/4/130477633/27a7372c59ca.pdf
    • http://5starlifestylehealth.com/uploads/1/3/0/7/130776457/lajibu-dijiwelapes-sevetinetowa-jopolonelilere.pdf
    • http://pilotprojects.net/uploads/1/3/0/4/130483429/3538228.pdf
    • http://kaleoramiah.com/uploads/1/3/0/7/130740368/8208601.pdf
    • http://74-123-72-38.mgwnet.com/uploads/1/3/0/4/130476158/130476158.html#basic+reading+exercises+for+kindergarten
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000032e6.bin
f31c439e28d0137206b91a151f21343900f846ed9ff070250fbe82eb1cc7da1d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x32E6 16204 bytes
font_01_sfnt_off00004a98.bin
479c64bdadd0adbcffb41092c3f18e39dbd30ee07d59e363b92963468972ea1a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4A98 7564 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.