Malicious PDF — malware analysis report

Static analysis result for SHA-256 763826201bb62513…

MALICIOUS

PDF

35.3 KB Authoring application: Mobipocket Creator
MD5: b3540e005fc89eb66b10206b43d054a1 SHA-1: 710e62d02c0de05663a7eabc24d3a308a649c388 SHA-256: 763826201bb625130658d77ca75da3c35b6ba95a8f45cfe2b73614cf00fc9faa
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded URLs pointing to other PDF files hosted on various domains. This behavior is indicative of a link farm or a distribution mechanism for further malicious content, as suggested by the 'PDF_SEO_LINK_FARM' heuristic and ClamAV detection. The ML classifier also strongly flagged this file as malicious. No scripts were extracted from this sample, but the sheer volume of external links suggests a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://mrdombaza.com/uploads/1/3/0/3/130323342/dupipagavo.pdf
    • http://moikaitrading.com/uploads/1/3/0/7/130739987/4273700.pdf
    • http://jparrismusic.com/uploads/1/3/0/3/130323612/07b1a.pdf
    • http://billsduckcarving.club/uploads/1/3/0/7/130776542/vobabugaxadiji-butukar-nibijuwizo-romavu.pdf
    • http://jasandjo.com/uploads/1/3/0/8/130813851/e38ed5cf82cc78.pdf
    • http://musicdepotrocks.com/uploads/1/3/0/6/130604207/makajexesunerapago.pdf
    • http://mydanielswaterfrontcondo.com/uploads/1/3/0/6/130621665/xinufipiz.pdf
    • http://nalbarra.com.au/uploads/1/3/0/3/130323232/6960277.pdf
    • http://drjesalvaphotography.com/uploads/1/3/0/2/130288391/ac8d2f.pdf
    • http://opusjobs.net/uploads/1/3/0/6/130621897/mafavozotiwa.pdf
    • http://www.basiccomputertutoring.com/uploads/1/3/0/2/130288361/noranazoxoromewep.pdf
    • http://www.barcrofts.co.uk/uploads/1/3/0/5/130589435/pifamalovevefanoxa.pdf
    • http://mykittykandy.com/uploads/1/3/0/5/130541103/patuda_zetofitupu_linep.pdf
    • http://stagandbarrel.co/uploads/1/3/0/6/130621826/1922580.pdf
    • http://erinlampa.com/uploads/1/3/0/7/130775032/6859156.pdf
    • http://honestlyabe.com/uploads/1/3/0/5/130540197/xalozekava.pdf
    • http://www.altogetheranna.ca/uploads/1/3/0/9/130969390/zatuvev-gelesope-sofiduxagifit-wepelolimidebow.pdf
    • http://www.ceonladesigns.com/uploads/1/3/0/6/130639530/5288708.pdf
    • http://hostmaster.pawsplayground.co.uk/uploads/1/3/0/5/130590413/kiniwivadolu_zidekafivowis_karuzi.pdf
    • http://notyourfathersadvisor.com/uploads/1/3/0/2/130270879/kexada_futogegivuwomax_bulabivegaturos.pdf
    • http://unitedinfood.com/uploads/1/3/0/7/130740389/15384843.pdf
    • http://courtneyscorner89.com/uploads/1/3/0/5/130551342/5249321.pdf
    • http://theaterworx.info/uploads/1/3/0/6/130605292/9716392.pdf
    • http://appraisejewelry.net/uploads/1/3/0/5/130545818/17a022.pdf
    • http://boxinyulechengdaili.br3h.com/uploads/1/3/0/8/130814021/130814021.html#ako+ay+pilipino+karaoke+song+download
    • http://hostmaster.pawsplayground.co

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000029a3.bin
2cd2023af86a95ab54b726576ada37b075204135ac7987fce3134f2205c79381		 pdf-font-stream PDF embedded font (sfnt) at offset 0x29A3 6616 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.