Malicious PDF — malware analysis report

Static analysis result for SHA-256 80b5789d5d32c138…

MALICIOUS

PDF

44.2 KB Authoring application: PDFedit
MD5: f274c5a84fa3e9e54989a6d42b6fe6c8 SHA-1: 12693415e08f6bf35be13775421d19263e5f8d54 SHA-256: 80b5789d5d32c13864fd3d93563fa57d81e84c7bef2175fea3465a51fa528565
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded links to external PDF files, a technique often used for SEO manipulation or to distribute further malicious content. The ML classifier and ClamAV detection strongly indicate malicious intent. The heuristic PDF_SEO_LINK_FARM specifically identifies the mass external link farm, with the first URL being http://simplyinspiredwords.com/uploads/1/3/0/5/130590019/9874288.pdf. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://simplyinspiredwords.com/uploads/1/3/0/5/130590019/9874288.pdf
    • http://meditationdownloadfiles.com/uploads/1/3/0/8/130813518/02f8c9def.pdf
    • http://www.daphneravey.com/uploads/1/3/0/7/130776895/lulobasutebojat.pdf
    • http://my-spiritual-garden.net/uploads/1/3/0/5/130540897/lewovo-pikodudul-ridudebokekop.pdf
    • http://beatrizgonzalezmusic.com/uploads/1/3/0/6/130639396/vigojog_gabiweguxugiko_milizesa_zunodi.pdf
    • http://openrunstudios.com/uploads/1/3/0/7/130739558/b90f94593dd894.pdf
    • http://www.dearherbook.com/uploads/1/3/0/7/130776693/244133.pdf
    • http://wheretheriverfrowns.com/uploads/1/3/0/4/130436399/sonozete_zokanonaforuwe_novarivo_gafajejoxesogas.pdf
    • http://ambienceflooringaustralia.com/uploads/1/3/0/7/130776821/156b6.pdf
    • http://airdrivenmusic.club/uploads/1/3/0/5/130589216/soxazodox-webazatiko.pdf
    • http://yasinrahim.com/uploads/1/3/0/6/130620454/1664478.pdf
    • http://utwatch.org/uploads/1/3/0/6/130620576/173aeaa4bf4b20.pdf
    • http://unidosporlaprofesion.com.ar/uploads/1/3/0/7/130775269/2274512.pdf
    • http://mcpowercleanltd.com/uploads/1/3/0/4/130488811/robilex_rodizigulixiner_jurasaneweku_wulefumagudo.pdf
    • http://rousemediaatl.com/uploads/1/3/0/8/130874676/lobakizavowow.pdf
    • http://miko-trans.pl/uploads/1/3/0/5/130547613/palosaxive.pdf
    • http://mypricelesspetals.com/uploads/1/3/0/3/130379415/8101912.pdf
    • http://nbptweddingplanner.com/uploads/1/3/0/6/130605442/043bca91155a4f7.pdf
    • http://74-123-72-164.mgwnet.com/uploads/1/3/0/5/130590261/fediluzenik.pdf
    • http://kristawassenaar.com/uploads/1/3/0/2/130289019/2860724.pdf
    • http://summervillepsych.com/uploads/1/3/0/4/130483351/2678419.pdf
    • http://bestestcasinos.com/uploads/1/3/0/5/130589399/nijolibevow.pdf
    • http://auntkates.com/uploads/1/3/0/5/130551523/d018c.pdf
    • http://thegenerousgig-makingmusicforacause.com/uploads/1/3/0/5/130539235/xonokikubuxemowedita.pdf
    • http://danecompany.com/uploads/1/3/0/6/130621292/188641a.pdf
    • http://seizediem.com/uploads/1/3/0/8/130813079/130813079.html#practice+reading+passages+for+5th+grade

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000474f.bin
8f9b1c574e9eb49ec9dbeb0916f966e85ae9b1ad5d058758274f3f4997df184b
pdf-font-stream PDF embedded font (sfnt) at offset 0x474F 8344 bytes