Malicious PDF — malware analysis report

Static analysis result for SHA-256 72cf662b71e08b3c…

MALICIOUS

PDF

48.3 KB Authoring application: QPDF
MD5: 8fbb7535536f12551e18b4d25fce15a8 SHA-1: 0ed6d350f5a274c1512b5ccd87b57c8d0fa1931f SHA-256: 72cf662b71e08b3ce5c28117dcf286639ba9833c9fce575e693812dd312b2228
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file contains a large number of embedded external links, identified as a link farm. This technique is often used to distribute malicious content or to engage in SEO poisoning. The ClamAV detection and ML classifier strongly indicate malicious intent, likely as a dropper for further malicious payloads.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Dropper.Agent-7740659-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Dropper.Agent-7740659-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://letstradeshirts.com/uploads/1/3/0/4/130435583/0f887113c9187.pdf
    • http://laineybean.net/uploads/1/3/0/6/130639222/c85b3f6cb3e2f.pdf
    • http://www.moormanfamilyfarms.com/uploads/1/3/0/7/130775395/tipijimimure.pdf
    • http://overnightposters.com/uploads/1/3/0/4/130476396/d4f7774.pdf
    • http://www.vonormytexas.com/uploads/1/3/0/5/130539033/zefuroximude-nesov.pdf
    • http://sincityedibleslv.com/uploads/1/3/0/8/130874530/jinilanotolejanu.pdf
    • http://kpcdesign.org/uploads/1/3/0/3/130313235/fivametemov-venujajot-nojokinidiw-xoxinudidexijel.pdf
    • http://library.ontariooregon.org/uploads/1/3/0/5/130539300/mijifop_roxojo_muzelosajumas.pdf
    • http://blakegaskin.com/uploads/1/3/0/7/130775675/8503317.pdf
    • http://datasciencetitan.com/uploads/1/3/0/3/130379117/7431b3a5c542654.pdf
    • http://mrfeed.org/uploads/1/3/0/2/130288600/3540206.pdf
    • http://alinazhukovskaya.com/uploads/1/3/0/5/130545485/22d52bef714d49f.pdf
    • http://mta-sts.mail.sfa-am.ch/uploads/1/3/0/7/130739340/rabusowebodidi_nibaxafed_noxosineg.pdf
    • http://netballinthecommunity.co.uk/uploads/1/3/0/8/130813550/deverekag_nemorowopudaru_vomikozi.pdf
    • http://publiceyenetwork.net/uploads/1/3/0/5/130544968/fexakenobo.pdf
    • http://thecannabisbusinessalliance.com/uploads/1/3/0/4/130483288/mikawotiwesex.pdf
    • http://shnhome.com/uploads/1/3/0/7/130776049/9c148e8765cc.pdf
    • http://www.thecoworkspace.co.za/uploads/1/3/0/6/130604737/713769.pdf
    • http://nationalhellenicsociety.net/uploads/1/3/0/2/130274305/2c15816b63.pdf
    • http://vegansofbrookhaven.com/uploads/1/3/0/6/130604782/wetam.pdf
    • http://kramerlawfirm.net/uploads/1/3/0/6/130621020/3690960.pdf
    • http://customweddingsoaps.com/uploads/1/3/0/7/130776065/6461909.pdf
    • http://sweeterthanhoney.dbbcso.org/uploads/1/3/0/7/130775985/mekoranozizuk.pdf
    • http://www.azprimeservices.com/uploads/1/3/0/5/130590413/bederoxube.pdf
    • http://austinpooldeck.com/uploads/1/3/0/2/130287548/zigevorisefugij_fowadu_zimutosabi.pdf
    • http://webdisk.themodestshoptx.com/uploads/1/3/0/7/130739129/130739129.html#abscesos+perianales+operacion

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005581.bin
c3ee64506b7e6ab5cd88765610f9303370687b5b6a220b175ec36a075277f5a4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5581 9456 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.