Malicious PDF — malware analysis report

Static analysis result for SHA-256 7503b9e2c89d29b1…

MALICIOUS

PDF

53.3 KB Authoring application: pdf-parser
MD5: 0df1ead99f6c7bbe53fe77a6427682c4 SHA-1: c5a5fd46943b605e5ed5cac3193d1ead4e71a5ec SHA-256: 7503b9e2c89d29b1ff217a175e871e253d7bba8aba681aa7fede82bb8fc0154f
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded URLs pointing to other PDF files, a technique often used for SEO manipulation or to distribute malware. ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the ML classifier output strongly indicate malicious intent. The primary function appears to be acting as a gateway to a network of linked malicious documents.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://salaamfundraiser.com/uploads/1/3/0/6/130605331/balabivaxexum-biwosimoxuwaz-kojexunetedeb.pdf
    • http://conquernorthwest.com/uploads/1/3/0/3/130313271/e456cd3.pdf
    • http://www.urmomcast.com/uploads/1/3/0/4/130483592/nadoxojavuvi_polerujikewi_wigepa_webufupin.pdf
    • http://nastynotfound.com/uploads/1/3/0/5/130550961/sowegukesividi.pdf
    • http://beyondthehardwood.org/uploads/1/3/0/3/130379319/2f6724944e9.pdf
    • http://74-123-76-172.mgwnet.com/uploads/1/3/0/9/130969936/lupawiderosodusonu.pdf
    • http://lpsintranet.com/uploads/1/3/0/5/130551714/8907571.pdf
    • http://waggintailsadrian.com/uploads/1/3/0/9/130969218/xoxaxudexili.pdf
    • http://michaelsheacounselling.com/uploads/1/3/0/8/130874324/nawuxufevuz.pdf
    • http://www.southbeltongt.net/uploads/1/3/0/7/130739746/8701541.pdf
    • http://poolsidenorthshore.com/uploads/1/3/0/4/130476427/1d30451b4.pdf
    • http://mirageestates.com/uploads/1/3/0/3/130323328/4422498.pdf
    • http://mlhas.com/uploads/1/3/0/6/130640219/koxujumakikibuf-wavusapum.pdf
    • http://discoveridyllwild.com/uploads/1/3/0/5/130540116/mabegoxelaborowolo.pdf
    • http://www.norweldstress.ca/uploads/1/3/0/8/130873986/ee61cdd2b6b5d15.pdf
    • http://museumeats.com/uploads/1/3/0/7/130738499/4707d3ff.pdf
    • http://74-123-75-234.mgwnet.com/uploads/1/3/0/6/130640194/c102e016.pdf
    • http://hospicehearts.org/uploads/1/3/0/2/130288458/6771889.pdf
    • http://ns1.tonisenatore.com/uploads/1/3/0/5/130588267/2a1e892016a033.pdf
    • http://mynastybath.com/uploads/1/3/0/7/130740609/1f27eb.pdf
    • http://heysciences.us/uploads/1/3/0/5/130543743/4398168.pdf
    • http://ext-web.drmarlenefarooq.com/uploads/1/3/0/3/130324170/c5bf033e24f3cd.pdf
    • http://www.yulebacreekstockhorses.com/uploads/1/3/0/7/130776104/1114736.pdf
    • http://sistim.biz/uploads/1/3/0/6/130604612/3092417.pdf
    • http://www.mulberrystreetrecords.com/uploads/1/3/0/8/130814232/valetejudidakeb_lusel_todediwoves.pdf
    • http://zuihaowanqipaiyouxi.br3h.com/uploads/1/3/0/7/130776648/130776648.html#testing+multiple+regression+assumptions+in+spss

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000013d6.bin
994d475ff3bc0cde09d1d1f3580a4e7167a9ade761fbafdb892a176e440aaefd		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13D6 8880 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.