Malicious PDF — malware analysis report

Static analysis result for SHA-256 890678d3061134b4…

MALICIOUS

PDF

56.0 KB Authoring application: Soda PDF
MD5: 34f328c023bae5960af9901269f00ccf SHA-1: 8c8f9d30b5d2ff5aff8f38b302e5ec2e9e6c4fd1 SHA-256: 890678d3061134b478c856ca1846e2150319e76c9ae1639e73d4718ab123cbd4
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded URLs pointing to other PDF files hosted on various domains. This behavior is indicative of a link farm or a distribution mechanism for further malicious content. The ClamAV detection and ML classifier strongly suggest malicious intent, likely related to phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://uptownslice.com/uploads/1/3/0/7/130739802/548e0.pdf
    • http://classyglow.com/uploads/1/3/0/5/130588518/fuxawabuwe_tisijesiv_medine.pdf
    • http://nishanonprofit.org/uploads/1/3/0/6/130639334/ef5de980cc5aaa.pdf
    • http://nangrayphotography.com/uploads/1/3/0/6/130604741/77403b2e69fdb.pdf
    • http://whitesflooring.com/uploads/1/3/0/5/130540240/133f170b.pdf
    • http://4kledtech.com/uploads/1/3/0/2/130272443/676d547b11.pdf
    • http://mitienditaluu.com/uploads/1/3/0/3/130313241/porepesiv_kovupumuruzadag.pdf
    • http://joycejudyfororegon.com/uploads/1/3/0/6/130621298/758c6.pdf
    • http://www.shustercomedy.com/uploads/1/3/0/4/130491001/4728585.pdf
    • http://5gset.net/uploads/1/3/0/7/130739098/wuvarabol.pdf
    • http://pleasuretron.com/uploads/1/3/0/5/130590143/zixiwulowewo.pdf
    • http://project-black.org/uploads/1/3/0/3/130313319/dixem-mukesob-xitonixo.pdf
    • http://simpleupscrm.com/uploads/1/3/0/6/130622048/8080588.pdf
    • http://www.palomaville.com/uploads/1/3/0/8/130814858/pekana-tazex-rafor-fupulupato.pdf
    • http://bet365yulechengwangzhi.br3h.com/uploads/1/3/0/6/130621432/130621432.html#exploratory+data+analysis+rstudio

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000129a.bin
7913a57a0fff906228c18aba2e001b4cc5d8121452bb05262184ebd91e0056a0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x129A 8708 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.