Malicious PDF — malware analysis report

Static analysis result for SHA-256 8668e76b9f85e16c…

MALICIOUS

PDF

58.2 KB Authoring application: PDFBox
MD5: 0c0544a3030a8ed2f697ab3eb5365100 SHA-1: e82d01781d6c9c3ab55a581b56bee1c6e686170a SHA-256: 8668e76b9f85e16c081153fcd8a3344f229fe3373ce3889a4c70cffb85883870
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded external links pointing to other PDF files hosted on various domains. This behavior is indicative of a link farm or redirection scheme, likely intended to lead users to malicious content or phishing sites. The ClamAV detection and ML classifier further support its malicious nature.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://albemarleop.com/uploads/1/3/0/5/130551704/da8424.pdf
    • http://kiscogear.com/uploads/1/3/0/4/130476172/3885503.pdf
    • http://landforsaleinlafayettecountyms.com/uploads/1/3/0/4/130491488/9efdd3.pdf
    • http://pvstateofmind.net/uploads/1/3/0/4/130476462/039d1.pdf
    • http://aplacetorest.org/uploads/1/3/0/3/130323164/bidajemopi.pdf
    • http://berenson.us/uploads/1/3/0/3/130379074/9608498.pdf
    • http://whiddenprinting.com/uploads/1/3/0/4/130488228/deviwotamire_vifuwagap_vilenidigo_nematebe.pdf
    • http://andrewthompsonsongs.com/uploads/1/3/0/2/130289243/juwemavivunep.pdf
    • http://sgdpress.com/uploads/1/3/0/7/130739347/9ba370f013e39.pdf
    • http://topcabletvdeals.com/uploads/1/3/0/7/130739584/supepiwet-rawub.pdf
    • http://mygabrielagarcia.com/uploads/1/3/0/4/130476351/lutafuxuwareb.pdf
    • http://keekswineco.com/uploads/1/3/0/8/130873932/74f232.pdf
    • http://richardeturley.com/uploads/1/3/0/7/130776343/sifisulifixo.pdf
    • http://pioneerwinecolorado.com/uploads/1/3/0/3/130312965/7505757.pdf
    • http://skulldiver.com/uploads/1/3/0/3/130323967/vuwiwatupiv.pdf
    • http://insituexperiences.com/uploads/1/3/0/7/130776612/monokam-varizopexakamid-sidol.pdf
    • http://haileysavestheday.com/uploads/1/3/0/5/130545581/73449dbebf11.pdf
    • http://queblesolutions.com/uploads/1/3/0/7/130739895/dfe04c.pdf
    • http://mindbody-solutions.net/uploads/1/3/0/6/130639855/torubage.pdf
    • http://agilicorp.com/uploads/1/3/0/5/130590569/0814c54ea5.pdf
    • http://teenmamagrown.com/uploads/1/3/0/7/130740389/1201213.pdf
    • http://cairokhanhotel.net/uploads/1/3/0/2/130287896/newimisufi-kadevavesusosox-najos.pdf
    • http://singaporenewexecutivecondo.com/uploads/1/3/0/5/130589064/mazijenir.pdf
    • http://taxi101.com/uploads/1/3/0/7/130739500/2108060.pdf
    • http://lanceduncan.com/uploads/1/3/0/9/130969931/9577028.pdf
    • http://kmipropertieslimited.com/uploads/1/3/0/6/130639162/130639162.html#inferior+wall+infarction+nitroglycerin

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001539.bin
cec6604d26823073f98e0ced41390c7eb3f3d930eb78c180c8b723d10d2d08e5		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1539 9112 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.