Malicious PDF — malware analysis report

Static analysis result for SHA-256 779d55ac8a6aae8b…

MALICIOUS

PDF

40.3 KB Authoring application: Pdftk
MD5: d3f82dfcccb53950732982bbbc405456 SHA-1: ecf1897bf35644985804efcc76a8edd08b185136 SHA-256: 779d55ac8a6aae8befc3ff8137a278a42075e9410f3dc35572cf7825ef52d23d
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. The ClamAV detection and ML classifier also indicate maliciousness, with the ClamAV signature suggesting a phishing or redirection campaign. While no scripts were extracted, the structure and heuristics strongly suggest this document is part of a link farm designed to redirect users to potentially malicious content hosted on numerous domains.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://reedhendersontrust.org/uploads/1/3/0/8/130813757/2e98e83.pdf
    • http://107redirect.com/uploads/1/3/0/6/130621741/c3bd01a0467f6b.pdf
    • http://longislandoverheaddoors.net/uploads/1/3/0/6/130620399/4438db5ccb.pdf
    • http://christinecaseyphotography.com/uploads/1/3/0/3/130323462/lufus.pdf
    • http://3dspecies.com/uploads/1/3/0/3/130313440/7859623.pdf
    • http://niacurriculum.com/uploads/1/3/0/8/130814967/5378075.pdf
    • http://myleftlane.com/uploads/1/3/0/6/130639642/vokuseronapiz-jivop-sovubower.pdf
    • http://bluethistle.agency/uploads/1/3/0/6/130605501/nelotuxe_rabidimigigo.pdf
    • http://naraxis.com/uploads/1/3/0/5/130588966/kotalig.pdf
    • http://swimleftlabs.com/uploads/1/3/0/7/130775640/8646471.pdf
    • http://bastion.co.nz/uploads/1/3/0/3/130313403/zololulejuxazexofo.pdf
    • http://reveriecoffeeco.com/uploads/1/3/0/5/130588596/susobatimuzozowijixo.pdf
    • http://www.sobergiving.org/uploads/1/3/0/7/130775940/visutevovadu-mimixidotu-loxujule-xujinuni.pdf
    • http://bfmix.com/uploads/1/3/0/6/130621043/3024019.pdf
    • http://tillerinternationalcapital.com/uploads/1/3/0/6/130621075/f9e4ed4e4074.pdf
    • http://nichellejensen4orem.com/uploads/1/3/0/5/130539448/kejusezaxosiw-dogofemotas-gugunu.pdf
    • http://45northfarm.com/uploads/1/3/0/6/130620451/meloxad.pdf
    • http://otownpyle.com/uploads/1/3/0/3/130323709/bazokaw.pdf
    • http://knifelawinsider.com/uploads/1/3/0/5/130588675/kadeta_kaxofov_geruk_xanoloxajaxa.pdf
    • http://zci-highered.com/uploads/1/3/0/2/130270897/8969186.pdf
    • http://d4pg5.bpmtc.com/uploads/1/3/0/6/130621805/130621805.html#abqaiq+to+riyadh+train+timings+and+fare
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_001_off00002105.bin
5e8c8e768a72892ecb0866b1fff82d9c97bc5530541a1cf1a8c6c8aac46142d7		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x2105 17812 bytes
font_01_sfnt_off00003e1a.bin
2bdfaa98b4e4663d17b9ef7ed782d8f584f17915a517f9890a7f85326ab0ef02		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3E1A 7744 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.