Malicious PDF — malware analysis report

Static analysis result for SHA-256 725bf412ff0592c3…

MALICIOUS

PDF

51.2 KB Authoring application: Mobipocket Creator
MD5: da3ee63accb2f178de381b1a5b6e5d92 SHA-1: 01c0851c4ef97b58ee939520f3514340ff2e4142 SHA-256: 725bf412ff0592c301abaebf10f988189f0635287109dd4d9a735ebbd8b39d1c
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1105 Ingress Tool Transfer

The PDF contains a large number of embedded URLs pointing to other PDF files hosted on various domains. This behavior is indicative of a link farm or a distribution mechanism for further malicious content. The ML classifier and ClamAV detection strongly support its malicious nature.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://modestohandyman.com/uploads/1/3/0/4/130483872/712a7e467b1d4f.pdf
    • http://nataliyatodorportfolio.com/uploads/1/3/0/5/130550910/dcca7ed55.pdf
    • http://merthyrmawrtrailrunningfestival.com/uploads/1/3/0/6/130604529/ff853edb1733b2d.pdf
    • http://219garage.com/uploads/1/3/0/6/130640022/vagemaguwa-dugoridufa-toxonubo-zikininoromo.pdf
    • http://eliteeuromotors.com/uploads/1/3/0/4/130488451/lelujobet-sikavipi.pdf
    • http://cvillefamilyhistorycenter.org/uploads/1/3/0/5/130543467/211836300058c9.pdf
    • http://coastnuflow.com.au/uploads/1/3/0/2/130288802/vipimisek.pdf
    • http://mythbay.com/uploads/1/3/0/5/130538987/zutogat_pawogoj.pdf
    • http://southwesterntennisservices.com/uploads/1/3/0/2/130272847/9439432.pdf
    • http://thehappygirlstore.com/uploads/1/3/0/5/130543148/130543148.html#the+promise+by+chaim+potok
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000012db.bin
ed4e40df762deb1cc62e3f70615fe8ababa0e237ec07ce853d72d0cc080d145a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12DB 8952 bytes
font_01_sfnt_off00007fa1.bin
2f116b9152d8f42202da03e39c1ea34507dd178996adf38e045857167aec94ef		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7FA1 16796 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.