Malicious PDF — malware analysis report

Static analysis result for SHA-256 821e37a4e9a7b1fd…

MALICIOUS

PDF

40.4 KB Authoring application: ImageMagick
MD5: c6608af88d7a868fa2fdd48696fb6e39 SHA-1: dba1674c94a19e465d76c416a73294c1f090558a SHA-256: 821e37a4e9a7b1fd2583ef775ecb054b1dd4197f27a3f2f263a36df9cdf06fcf
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF file was flagged by multiple heuristics, including a critical PDF_SEO_LINK_FARM rule and ClamAV detection for Pdf.Phishing.TtraffRobotInstall. The presence of 24 embedded external PDF links, with the first pointing to nicolasandysmillinery.com, strongly suggests a traffic-driving or phishing campaign. The ML classifier also returned a high confidence score for maliciousness.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://nicolasandysmillinery.com/uploads/1/3/0/3/130323477/364163.pdf
    • http://happyvids.com/uploads/1/3/0/4/130476557/4630660.pdf
    • http://ametkorca.com/uploads/1/3/0/7/130738893/8203903.pdf
    • http://meno-poise.com/uploads/1/3/0/2/130272921/kabusiji-zomupukajozo-tiwegodeg-xibugej.pdf
    • http://himalayantales.co.uk/uploads/1/3/0/5/130542692/8378683.pdf
    • http://houstonofficespace.net/uploads/1/3/0/5/130539659/dfa84daf4830d6.pdf
    • http://oddballdigital.com/uploads/1/3/0/4/130478110/fc2f3ea13b.pdf
    • http://thecottonshops.com/uploads/1/3/0/6/130620163/fakisina-nanijijatirig-matos.pdf
    • http://withgrandmabarbara.com/uploads/1/3/0/3/130323733/9161033.pdf
    • http://summerfoxart.com/uploads/1/3/0/4/130490602/duvukexogag.pdf
    • http://auditfindings.net/uploads/1/3/0/4/130436415/maneba.pdf
    • http://blasphemouslines.com/uploads/1/3/0/8/130873779/pawololaxofosex-lesuke-taxul.pdf
    • http://myrabi.com/uploads/1/3/0/4/130489131/1768605.pdf
    • http://aflqua.com/uploads/1/3/0/5/130590677/pasujeregazit-memowovu.pdf
    • http://www.hernur.com/uploads/1/3/0/6/130620379/cd72a33.pdf
    • http://motionautodetailing.net/uploads/1/3/0/7/130775228/buzoxejatezaxedoj.pdf
    • http://the-business-solutions.com/uploads/1/3/0/6/130639784/524b3c71.pdf
    • http://mosaico.ch/uploads/1/3/0/6/130604286/cb893.pdf
    • http://lilgrayrabbit.com/uploads/1/3/0/7/130775429/4740090.pdf
    • http://alphachildbirth.ca/uploads/1/3/0/6/130639827/vonerewidul-nolubajobuj.pdf
    • http://calgarymobileiv.com/uploads/1/3/0/6/130639165/2062671.pdf
    • http://agapekennelswhitewater.com/uploads/1/3/0/5/130551021/63253.pdf
    • http://caltempmissionb.org/uploads/1/3/0/4/130483510/zubabozutagozidefil.pdf
    • http://discovercaddogap.com/uploads/1/3/0/6/130639782/gilowud.pdf
    • http://74-123-77-80.mgwnet.com/uploads/1/3/0/6/130603709/130603709.html#cosmic+girl+bass+pdf
    • http://www.hernur.com/uploads/1

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000391d.bin
bfd6d14dda3e1d9f9939c305bce1e66f011f5b741eb6a2c6e2f6a91a738b405e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x391D 9236 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.