Malicious PDF — malware analysis report

Static analysis result for SHA-256 820e4ec7dfd6cbc5…

MALICIOUS

PDF

44.3 KB Authoring application: GIMP
MD5: e042e442321703922549c8f8ca4f8f49 SHA-1: 0a846b148835c073584f1cc902de598967dd1500 SHA-256: 820e4ec7dfd6cbc5c2d2b623932d527dd487697fd528ae1c16036cf2393d52e5
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links to other PDF files hosted on various domains, a technique often used for SEO manipulation or to distribute further malicious content. The ClamAV detection and ML classifier strongly indicate malicious intent. The heuristic 'PDF_SEO_LINK_FARM' explicitly identifies the mass external PDF link farm, with 'solutionslocker.com' being the dominant host for these links.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Dropper.Agent-7807492-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Dropper.Agent-7807492-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://solutionslocker.com/uploads/1/3/0/7/130776219/4209510.pdf
    • http://manrajminhas.com/uploads/1/3/0/2/130287548/7901a1fe.pdf
    • http://luckofthedraw.fun/uploads/1/3/0/5/130588164/pukosuronovibe.pdf
    • http://montecarloproductionsmagazine.com/uploads/1/3/0/6/130621455/fizikotoliz_nibamir_zevotubid.pdf
    • http://moonrisefall.com/uploads/1/3/0/5/130543366/1888891.pdf
    • http://nu-trek.com/uploads/1/3/0/6/130605396/bubinikumasiw.pdf
    • http://bestgeekdeals.com/uploads/1/3/0/3/130323997/1374189.pdf
    • http://ascinsurescaffoldtoolbox.com/uploads/1/3/0/7/130775808/ketotijomores.pdf
    • http://journeylaurel.net/uploads/1/3/0/5/130588564/4701612.pdf
    • http://thesouthernscene.com.au/uploads/1/3/0/5/130588282/6bf5d9.pdf
    • http://myerstownboyscouts.com/uploads/1/3/0/6/130605307/giwofafuxukim.pdf
    • http://sehatwalafiat.net/uploads/1/3/0/7/130738632/9281501.pdf
    • http://noridirg.com/uploads/1/3/0/6/130620343/laporaj.pdf
    • http://personalnetworkappliances.net/uploads/1/3/0/5/130550724/wajij.pdf
    • http://lumlatist.com/uploads/1/3/0/5/130588457/resafeva-wuwixesi-fixironefi-nejogalul.pdf
    • http://samsungsmarthome.net/uploads/1/3/0/6/130639578/2966746.pdf
    • http://sherpublishing.com/uploads/1/3/0/7/130739850/7989022.pdf
    • http://mytmch.com/uploads/1/3/0/6/130605501/32b54a43a1ee93.pdf
    • http://www.weeblyreview.com/uploads/1/3/0/7/130739445/130739445.html#nursing+diagnosis+for+perforated+ulcer
    • http://solutionslocker

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005043.bin
239d3d8b4c9fa20d860a642341712f938b5e294c1b060667bcd63e6a11afa37b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5043 7968 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.