Malicious PDF — malware analysis report

Static analysis result for SHA-256 741d17ac1326a471…

MALICIOUS

PDF

48.5 KB Authoring application: Soda PDF
MD5: 2d94d573c774e23b56e878559e5af62d SHA-1: 0852867d750d170f0b8d01e30579dbaebed4de73 SHA-256: 741d17ac1326a47185ed40386b57af09ceda0c37aaa402fb6365f50ae8745da3
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file contains a large number of embedded links to external PDF documents hosted on various domains, as indicated by the PDF_SEO_LINK_FARM heuristic. This suggests a link farm or a distribution mechanism for further malicious content. The ML classifier and ClamAV also flagged this file as malicious, specifically as a phishing or robot-related PDF. No scripts were extracted, but the embedded URLs are the primary indicators of malicious activity.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://mac-setup.co.uk/uploads/1/3/0/3/130323360/somanulabumoburivifu.pdf
    • http://arthurdogsontodd.net/uploads/1/3/0/3/130323884/6287861.pdf
    • http://www.aspemag.com/uploads/1/3/0/4/130436125/4365920.pdf
    • http://brownmediadesigns.com/uploads/1/3/0/2/130274032/ritevodamuwabib.pdf
    • http://myroyalorganics.com/uploads/1/3/0/7/130775633/nonogilof.pdf
    • http://webeditormike.com/uploads/1/3/0/4/130477335/e9f392ccf.pdf
    • http://lakegenevapsychologist.com/uploads/1/3/0/7/130776046/wipetavusefenuv.pdf
    • http://actingcoachlasvegas.com/uploads/1/3/0/5/130544243/3889056463.pdf
    • http://eliteeuromotors.com/uploads/1/3/0/2/130288523/320607.pdf
    • http://natalietremblay.ca/uploads/1/3/0/5/130551053/cb5411b987d4.pdf
    • http://amigos-de-la-montana-de-zamora-y-jacona.org/uploads/1/3/0/5/130547999/3887caf7ad3.pdf
    • http://trophybearer.org/uploads/1/3/0/5/130588805/nefabodotubezizos.pdf
    • http://www.myrocketflow.com/uploads/1/3/0/5/130588934/5838739.pdf
    • http://mercedregionalvision.com/uploads/1/3/0/7/130740148/6f5fb973e8.pdf
    • http://easytobuyahouse.com/uploads/1/3/0/2/130291838/5692695.pdf
    • http://renotahoetonightmagazine.com/uploads/1/3/0/4/130476054/4429753.pdf
    • http://mta-sts.mx.grandsalinelibrary.com/uploads/1/3/0/7/130739488/130739488.html#sickle-cell+anemia+is+a+disease+that+is+caused+by+in+the+_+of+the+protein
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://fedoraproject.org/wiki/Licensing/LiberationFontLicense

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000051ee.bin
c048ac4ed90d63bfae46472f65f9cf6fc0bd5e75369f2d8f28771a6d96a2731c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x51EE 3156 bytes
font_01_sfnt_off00005fab.bin
dc8008086d6adb5b94016ebdafa527b41ec7d0eeb2df0b7c3732618bdd86633f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5FAB 8884 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.