Malicious PDF — malware analysis report

Static analysis result for SHA-256 6ededfae091f267d…

MALICIOUS

PDF

37.5 KB Authoring application: Serif PagePlus
MD5: f6b0b91b942974d7e1b456d5ae850b24 SHA-1: 66a2034b3833971843f468e328fae0306507408d SHA-256: 6ededfae091f267dd2e4ff9f29ff42250cb33945e3da83e9c59818700ec53a76
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file contains a large number of embedded URLs pointing to other PDF files across various domains. This behavior is indicative of a link farm or a distribution mechanism for further malicious content. The ClamAV detection and ML classifier strongly suggest malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://saromas.com/uploads/1/3/0/5/130538816/zulewisaxapuxog_nuvilobuxape_bevivajo_zaboralovom.pdf
    • http://kunstglad.no/uploads/1/3/0/8/130874031/1dfe62697.pdf
    • http://bienchulitos.com/uploads/1/3/0/4/130476148/zegogaraguwemur.pdf
    • http://shopofficeglam.com/uploads/1/3/0/7/130738948/9046231.pdf
    • http://mygabrielagarcia.com/uploads/1/3/0/7/130776213/fubuve.pdf
    • http://untameddemure.com/uploads/1/3/0/6/130621640/lumesukiwidokud.pdf
    • http://culturalinnovationgroup.org/uploads/1/3/0/5/130545097/sekejavakifelu.pdf
    • http://www.apsupplychain.com/uploads/1/3/0/3/130323318/litox-gezafebezu-masugixata.pdf
    • http://tankgirl.com/uploads/1/3/0/5/130589397/27a2b.pdf
    • http://steepingleaves.com/uploads/1/3/0/5/130542934/ganabodefal.pdf
    • http://communiqueventures.com/uploads/1/3/0/5/130551604/vujagexakobiveri.pdf
    • http://augusta-flooring.com/uploads/1/3/0/7/130775853/daddc9.pdf
    • http://steerking.us/uploads/1/3/0/7/130739519/pajere-mefad-rogalufezab-wezufikovufuni.pdf
    • http://yourcloudcrowd.com/uploads/1/3/0/4/130490488/fudepadolimirared.pdf
    • http://million-minds.org/uploads/1/3/0/5/130588150/dijakeriba.pdf
    • http://airsoftmanitoba.com/uploads/1/3/0/5/130551266/jepaleg.pdf
    • http://rockerrdigital.com/uploads/1/3/0/5/130551556/8114114.pdf
    • http://mcclinton.net/uploads/1/3/0/5/130589442/6750116.pdf
    • http://melaniejacob.com/uploads/1/3/0/7/130738790/mitegudoguvuluw.pdf
    • http://sff7l.salon225.com/uploads/1/3/0/2/130271111/130271111.html#how+to+find+the+font+from+a+logo+or+image

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003483.bin
4d9978edf701066b8874524b4703ff69707f7218fcb4061104ee4e6fa1d2008e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3483 7800 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.