Malicious PDF — malware analysis report

Static analysis result for SHA-256 8e0865584e9f660a…

MALICIOUS

PDF

43.0 KB Authoring application: ImageMagick
MD5: 132b554ec1f06eded824843735b69b75 SHA-1: e7b8c0f3dbd1cdc9c3a8188d73f953c4a15b98dc SHA-256: 8e0865584e9f660a7045d7a748a81487229601a6245e87060ccf1ec693463505
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. The ClamAV detection and ML classifier strongly indicate maliciousness, with the embedded links likely serving as a lure for phishing or to distribute further malware. The primary domain associated with the link farm is down-the-block.com.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://down-the-block.com/uploads/1/3/0/4/130436450/7628208.pdf
    • http://ablehorsewomanship.com/uploads/1/3/0/6/130603882/kapixanidomorufule.pdf
    • https://gamavikemaf.weebly.com/uploads/1/3/0/4/130435982/tuguti.pdf
    • http://triumphbikerentals.com/uploads/1/3/0/2/130274304/zomujuramak-kemogevowu-gaxovezoxik-zotenobelo.pdf
    • http://michaeldietze.net/uploads/1/3/0/4/130483300/potukefefepiweg.pdf
    • http://miacurcargo.com/uploads/1/3/0/6/130639331/jibeli.pdf
    • http://newsovereigncars.co.uk/uploads/1/3/0/2/130272330/niraputevolo_givipalanuzama_puripemoz_tujawop.pdf
    • http://stand2serve.org/uploads/1/3/0/5/130539316/5d85a4238c57.pdf
    • http://efcoform.com/uploads/1/3/0/4/130489563/6ccd7b0c4e3c59.pdf
    • http://differentstrokes-painting.com/uploads/1/3/0/2/130289282/5159047.pdf
    • http://movalhome.net/uploads/1/3/0/6/130621625/9095455.pdf
    • http://rocknreelcc.com/uploads/1/3/0/5/130588214/junir.pdf
    • http://nupelicanparty.org/uploads/1/3/0/4/130436207/130436207.html#why+crave+chocolate+during+period

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001507.bin
554cdbb357d8d572d08d789c496c0cc5308bf59982416fee03b34388de3d6cf8		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1507 8308 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.