Malicious PDF — malware analysis report

Static analysis result for SHA-256 70b4713401b0d3b9…

MALICIOUS

PDF

37.8 KB Authoring application: pdf-parser
MD5: f0d93f919fd6974ba44f47847f51a8b1 SHA-1: ac3c852758ecde73dcf7b0018769c12af19ab155 SHA-256: 70b4713401b0d3b978a9641fcb33881b5740613d16e520efde60661464ecf068
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded URLs pointing to other PDF files hosted on various domains. This behavior is indicative of a link farm or a distribution mechanism for further malicious content, as flagged by the 'PDF_SEO_LINK_FARM' heuristic. The ML classifier and ClamAV detection strongly suggest malicious intent, likely related to phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.guarderobe.com/uploads/1/3/0/2/130270942/1209730.pdf
    • http://webmail.riavoice.com/uploads/1/3/0/4/130483684/1850440e4b37.pdf
    • http://aspccc.com/uploads/1/3/0/7/130775075/e8aad.pdf
    • http://dotcoder.com/uploads/1/3/0/4/130489431/bozixilaj.pdf
    • http://telecelpromo.com/uploads/1/3/0/5/130544321/5358824.pdf
    • http://storedesigns.in/uploads/1/3/0/3/130324386/linazejuv.pdf
    • http://soulsigns.co.uk/uploads/1/3/0/7/130775339/6374388.pdf
    • http://comfyk.com/uploads/1/3/0/6/130604225/5416322.pdf
    • http://attunedreach.com/uploads/1/3/0/8/130873802/zasupikulitoravatupu.pdf
    • http://cbeng.ca/uploads/1/3/0/5/130551764/5211341.pdf
    • http://millsdigital.com/uploads/1/3/0/3/130379465/tojajiwitome_sokexasete_luwijovudogow_mugakonivik.pdf
    • http://charmlitmagshop.org/uploads/1/3/0/6/130620265/suwakunuxaferesaw.pdf
    • http://mail.pitzertravels.com/uploads/1/3/0/5/130588982/7b6e5c4.pdf
    • http://999fmradiomanila.com/uploads/1/3/0/3/130323407/vemil-dovixa.pdf
    • http://nikosmarinos.com/uploads/1/3/0/4/130483645/jubatusit_pujododulik_sanonefokinawi.pdf
    • http://www.ihc-korea.org/uploads/1/3/0/5/130550920/abfbb0b2b9c.pdf
    • http://wxstuff.com/uploads/1/3/0/5/130544086/tulodelajatev_fuposi_lodizusadewu_tovafebaxujotu.pdf
    • http://bellevistaassistedliving.com/uploads/1/3/0/5/130538949/ribam.pdf
    • http://brussels-computers.net/uploads/1/3/0/6/130620389/wunogu_nemuralakofuva.pdf
    • http://fancyklutz.com/uploads/1/3/0/2/130289733/futemarikibakob.pdf
    • http://www.mari-designs.com/uploads/1/3/0/2/130289466/7167388.pdf
    • http://www.epopeia-records.pt/uploads/1/3/0/2/130270867/wuzuzunad.pdf
    • http://theatlantadoula.com/uploads/1/3/0/6/130604630/zerovinugenofila.pdf
    • http://wd-consult.com/uploads/1/3/0/5/130544070/cf920.pdf
    • http://nudevember.com/uploads/1/3/0/2/130271190/e76e815781ba920.pdf
    • http://sta-66-99-58-206.ladse.org/uploads/1/3/0/6/130620659/130620659.html#modifiers+adjectives+and+adverbs+examples

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002fc2.bin
a1e77f720ea4260d624e27013dec9fd1255a64206f7628c9cf5bf805feed8332		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2FC2 7820 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.