Malicious PDF — malware analysis report

Static analysis result for SHA-256 711048ae14dacad8…

MALICIOUS

PDF

37.5 KB Authoring application: Mobipocket Creator
MD5: a4abba8a0496aa6444ab32dbd851a430 SHA-1: 642a9898b3b70113906e2076868088e1306bf89b SHA-256: 711048ae14dacad890efec48aa8f165307324a28a8d8a2a762845290ea48a24b
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains a mass external link farm, directing users to numerous other PDF files under the guise of a free converter. This behavior is indicative of a phishing or spam campaign aimed at driving traffic to malicious or unwanted content. The ML classifier and ClamAV detection strongly support its malicious nature.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://night-at-the-museum-rotary.org/uploads/1/3/0/6/130639364/5875448.pdf
    • http://ncmusictherapy.org/uploads/1/3/0/2/130270946/jizugatoj.pdf
    • http://cothrons.net/uploads/1/3/0/4/130489898/malix-tataragula-fuditawotuzigim.pdf
    • http://sweetpeasdreamzzz.com/uploads/1/3/0/5/130551058/muzewe_paned_kijizebe_taximime.pdf
    • http://zoroclean.com.au/uploads/1/3/0/7/130775651/5fbe2b733d3189.pdf
    • http://www.dcwerkmeister-consulting.com/uploads/1/3/0/2/130272462/d657c54c.pdf
    • http://playazball.com/uploads/1/3/0/6/130639652/rogevafovavoki.pdf
    • http://alaskacharr.org/uploads/1/3/0/3/130323538/lujobadun.pdf
    • http://colorfulmindsaustin.net/uploads/1/3/0/6/130621643/pojozadevufep.pdf
    • http://auntybencookie.com/uploads/1/3/0/2/130272394/tekatatomoxine.pdf
    • http://braveangelyoga.com/uploads/1/3/0/2/130291724/mifolejijiwo-sipisajazojuni-metejinexeg.pdf
    • http://greyhousevintage.com/uploads/1/3/0/8/130874175/totawigeforaj.pdf
    • http://grafologiacercana.es/uploads/1/3/0/6/130640067/cc12cd77a98d.pdf
    • http://educatormartins.com/uploads/1/3/0/8/130813586/babanixiwatudek.pdf
    • http://eandmclub.com/uploads/1/3/0/4/130476276/pefiruzef-bidig.pdf
    • http://teleprofile.net/uploads/1/3/0/6/130621068/0bcef169bf71cd9.pdf
    • http://axesatmobility.com/uploads/1/3/0/6/130621531/nuwog.pdf
    • http://idigporn.com/uploads/1/3/0/4/130483370/dee4f6e93e.pdf
    • http://tahitianvillageapartments.com/uploads/1/3/0/5/130590138/734754.pdf
    • http://chuyitos.com/uploads/1/3/0/4/130483512/petunugokizug.pdf
    • http://stripperguy.com/uploads/1/3/0/6/130621298/534867.pdf
    • http://lazera.com/uploads/1/3/0/8/130814290/fumis.pdf
    • http://3dklx.bpmtc.com/uploads/1/3/0/5/130589032/130589032.html#changing+pdf+to+word+for+free

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000030ea.bin
b163ebca2ff3c9a00b1f156ed6af3ef1ffd9674a894955dfbcd2873110c4abe6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x30EA 7912 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.