Malicious PDF — malware analysis report

Static analysis result for SHA-256 6d24a907de790a3d…

MALICIOUS

PDF

46.2 KB Authoring application: Pdftk
MD5: 6e9b4c117f4ab30b616ff19b08b69ff0 SHA-1: d6011661efb5ffba506a417a09ba29d9f7a1aa74 SHA-256: 6d24a907de790a3d20383378d5153ae703f7ffe54bd66fef14266879e45b0b9d
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF file contains a large number of embedded external links, as indicated by the 'PDF_SEO_LINK_FARM' heuristic. These links point to numerous other PDF files hosted on various domains, suggesting a tactic to manipulate search engine results or distribute a large volume of content. The ClamAV detection and ML classifier further confirm its malicious nature, likely related to phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://drkronos.ru/uploads/1/3/0/8/130813448/633928.pdf
    • http://northmoruyasolarfarm.com.au/uploads/1/3/0/8/130814250/dovaveze_ziramevut.pdf
    • http://thedogmom.net/uploads/1/3/0/3/130324420/rurefewuku_kukaz_todosan.pdf
    • http://biweeklypro.com/uploads/1/3/0/7/130775109/eae99ff03.pdf
    • http://conversionpix.com/uploads/1/3/0/4/130483318/ratasinagunus.pdf
    • http://domterapii.com/uploads/1/3/0/5/130551051/xetajivo.pdf
    • http://qaoi.org/uploads/1/3/0/4/130483418/fesivebazojo_nonuvozarofo_wesozekomo.pdf
    • http://snappees.com/uploads/1/3/0/5/130590671/pemuxagamokegirawexi.pdf
    • http://barkleypet.com/uploads/1/3/0/2/130288492/425567.pdf
    • http://solutioncities.org/uploads/1/3/0/2/130289304/a58250682.pdf
    • http://holidaysoffbroadway.com/uploads/1/3/0/5/130539652/pumalibo.pdf
    • http://seattleatheists.net/uploads/1/3/0/6/130603944/didawerava.pdf
    • http://toobusymomsbooks.com/uploads/1/3/0/3/130323291/43cdddf5794.pdf
    • http://petpalspetandhomecare.com/uploads/1/3/0/7/130776858/3692488.pdf
    • http://misfitsagony.com/uploads/1/3/0/6/130620207/729227.pdf
    • http://2dve3.salon225.com/uploads/1/3/0/8/130874126/130874126.html#hypothesis+testing+ppt+pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://fedoraproject.org/wiki/Licensing/LiberationFontLicense
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000031dd.bin
77470f5ab7beb1b709727d1a1b090181267d078bd57ffcb06a1e1780a67a046f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x31DD 3272 bytes
font_01_sfnt_off00003ca5.bin
df5efbd9f539e0d3dc767554fbaab5991a9d69fd3343e08a3c9d199245486688		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3CA5 16064 bytes
font_02_sfnt_off00005486.bin
c4b499fa2472176eaf2b2388875cb2d0665b6b7d281df3600b5c40bc4bb525ec		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5486 9820 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.