Malicious PDF — malware analysis report

Static analysis result for SHA-256 75047f4ce3af2121…

MALICIOUS

PDF

39.8 KB Authoring application: Adobe PDF Library 9.0
MD5: 1f50235e886ddeef61f1e082e8d109a6 SHA-1: d3221988fe7af10886e485027e4f45def8d01f67 SHA-256: 75047f4ce3af212178804834e44222faed5ffaefdfc4877293d151e6e3b86b2a
192 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF file contains a large number of external links, characteristic of a link farm designed to distribute malicious content. The ClamAV detection and ML classifier strongly indicate malicious intent, specifically identified as a phishing or traffic redirection campaign. The document body, though heavily obfuscated, appears to be a lure, possibly related to study guides, to encourage users to click the embedded links.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://maynframetechnology.com/uploads/1/3/0/4/130475932/bukizukikap.pdf
    • http://fairfieldcustom.com/uploads/1/3/0/5/130588542/8988637.pdf
    • http://soloinsurancequotes.com/uploads/1/3/0/6/130604935/wuwek.pdf
    • http://midwestlightingllc.com/uploads/1/3/0/7/130776760/zosufunajom.pdf
    • http://aenderungschneiderei-musovic.com/uploads/1/3/0/4/130488875/kuxigazude.pdf
    • http://awakewego.com/uploads/1/3/0/7/130776006/069b5fc7c400a3d.pdf
    • http://hostmaster.jonahgemeente.nl/uploads/1/3/0/5/130540664/vedotoj.pdf
    • http://advancedinstallations.com/uploads/1/3/0/5/130550803/a5457.pdf
    • http://www.vivere-slow-com.vincentstocklin.com/uploads/1/3/0/7/130740622/5ebba514.pdf
    • http://questchurchonline.org/uploads/1/3/0/6/130621475/litusakeni_pukawenu_kajazasebatuku_bikekewasuw.pdf
    • http://kateyanne.com/uploads/1/3/0/2/130289799/xevukizalavola.pdf
    • http://2015.cvillechambermusic.org/uploads/1/3/0/3/130313333/puvusimiw_savuvepawuba_tenuwufibusa.pdf
    • http://klutch.life/uploads/1/3/0/5/130589409/fofifu-geledofa.pdf
    • http://adayofhope.co/uploads/1/3/0/6/130605390/wosijololidowa-nadifasag.pdf
    • http://facialcosmeticsurgerynose.com/uploads/1/3/0/7/130775154/sakol-kabitawumo.pdf
    • http://www.hochzeitvonalisiaundrick.de/uploads/1/3/0/7/130776492/130776492.html#unit+4+test+study+guide+solving+quadratic+equations+answer+key

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003e00.bin
dbb0d221a869bba34ad01c2daeb9bb772c213cca7d6c0ef2063dabb2034adb61		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3E00 8856 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.