Malicious PDF — malware analysis report

Static analysis result for SHA-256 72e5e40caa67dc4a…

MALICIOUS

PDF

37.5 KB Authoring application: Mobipocket Creator
MD5: cd39027c44ac02f0fcf6cb541611921f SHA-1: 8f3e66ce1ee60392cef9af0dc1ee9db2c82f36d5 SHA-256: 72e5e40caa67dc4af4c6f2cd722fc53e49dd60eb50a2a08cc8b56c5ba6a1a23a
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF file was detected as malicious by multiple heuristics, including ClamAV and an ML classifier, and contains a large number of external links to other PDF files. The document body, though heavily obfuscated, contains references to PDF conversion tools and embedded URLs, suggesting a phishing or malware distribution scheme. The primary attack pattern involves luring users to download further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://psloveu.org/uploads/1/3/0/2/130287472/jibakisuverajojoluk.pdf
    • http://uclagsa.org/uploads/1/3/0/4/130476157/jivibuzemuzumam.pdf
    • http://newbritainlimecement.net/uploads/1/3/0/7/130740338/8171749.pdf
    • http://biggdaddysphillysteakhouse.com/uploads/1/3/0/2/130271184/kemajivagetojademoxe.pdf
    • http://dewynns.com/uploads/1/3/0/7/130739944/dakizolaza.pdf
    • http://firstaidhawaii.com/uploads/1/3/0/5/130551487/fexalemi.pdf
    • http://cohesivecode.org/uploads/1/3/0/5/130542977/rokitup_fojakulafeso_biwopelujizi_minavidosige.pdf
    • http://compher.net/uploads/1/3/0/6/130621854/5910862.pdf
    • http://sterlingroofingandrepair.com/uploads/1/3/0/7/130776577/jasuga_kuxax_jisugopibapipe_kuneminelixulak.pdf
    • http://shields-data.com/uploads/1/3/0/2/130287296/e2fafdc9.pdf
    • http://playersshack.com/uploads/1/3/0/5/130545684/1906389.pdf
    • http://ohhousecleaners.com/uploads/1/3/0/7/130740193/a626da6eb2074.pdf
    • http://criticaluniversitystudies.net/uploads/1/3/0/3/130313241/5793420.pdf
    • http://restaurant.nomadsadventurequest.com/uploads/1/3/0/4/130478470/b03329e53.pdf
    • http://warriorempath.com/uploads/1/3/0/7/130776887/6639569.pdf
    • http://riverglenwealthcounselors.com/uploads/1/3/0/5/130589135/xaxezuwawatavajo.pdf
    • http://minidvdworld.com/uploads/1/3/0/3/130313567/gejuxejorodogut_pafizibe.pdf
    • http://pawbehaviour.com/uploads/1/3/0/2/130291371/puxidi-nomera-sagozinisori-perobi.pdf
    • http://bestmd.space/uploads/1/3/0/2/130288317/sedozomutex.pdf
    • http://juliettegeraghty.com/uploads/1/3/0/2/130289676/0b19447cc9.pdf
    • http://marketpartnerz.com/uploads/1/3/0/6/130620840/674286905dbd7.pdf
    • http://accoladetechnoheights.com/uploads/1/3/0/7/130775753/didupovud_rizuxugilodug_mezef.pdf
    • http://raventacticalaz.com/uploads/1/3/0/7/130739559/4662463.pdf
    • http://mx10.carmichaelnl.com/uploads/1/3/0/7/130739309/130739309.html#pdf+to+excel+converter+offline+free

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002fec.bin
d025dfaad774b9779b5a93072421cbbf23923537731657f78672641ab1152082		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2FEC 7752 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.