Malicious PDF — malware analysis report

Static analysis result for SHA-256 8f615acd537678cb…

MALICIOUS

PDF

37.3 KB Authoring application: ImageMagick
MD5: b57f8c125d2acaba782c97307bc2bc18 SHA-1: c2e2de0f931a175a9b199a91fedde3a2a62524d7 SHA-256: 8f615acd537678cb517497a55bfc46cc8bf160ea7ac7d1a2d0268f747066d30b
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links to external PDF files, a technique often used for SEO poisoning or distributing malicious content. The ClamAV detection and ML classifier strongly indicate malicious intent. The document body, though heavily corrupted, contains fragments suggesting a lure related to PDF to Word conversion, which is consistent with the link farm heuristic.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://patlyonscreations.com/uploads/1/3/0/4/130488399/2c8bb2a.pdf
    • http://broselectrical.com/uploads/1/3/0/5/130538986/wipojukavurun.pdf
    • http://spirit1design.com/uploads/1/3/0/5/130551366/2101050.pdf
    • http://newoutsiderart.com/uploads/1/3/0/3/130379058/0cdf52db08275e.pdf
    • http://nokia-review.com/uploads/1/3/0/5/130588366/83cd54d4a5.pdf
    • http://hostmaster.cathymactaggartartist.com/uploads/1/3/0/5/130551041/4595579.pdf
    • http://drkronos.ru/uploads/1/3/0/6/130605048/6245235.pdf
    • http://mybarbabez.com/uploads/1/3/0/7/130775102/3df76212808c1a.pdf
    • http://autodiscover.woodsongherbs.com/uploads/1/3/0/5/130538985/wabesagiwot.pdf
    • http://theles-bijoux-de-chris-de-paris.com/uploads/1/3/0/2/130289589/nusarunoruxa.pdf
    • http://tried-by-fire.com/uploads/1/3/0/5/130588943/7763026.pdf
    • http://www.landseerproperties.net/uploads/1/3/0/7/130775589/jokusabejujo.pdf
    • http://misbirmingham.com/uploads/1/3/0/7/130776131/2e7e7e8a3401b9.pdf
    • http://sacredhearts.ca/uploads/1/3/0/2/130288391/selilubizoz_xesug.pdf
    • http://www.churchstrettontaxi.com/uploads/1/3/0/6/130620547/8669ec.pdf
    • http://handymanofgreenhills.com/uploads/1/3/0/6/130621479/619233.pdf
    • http://apricotcoaching.com/uploads/1/3/0/2/130289778/5ea2ef3.pdf
    • http://voicedoutcomesdirectory.com/uploads/1/3/0/7/130739253/wonovogo_kenig_fopijom.pdf
    • http://mayaoak.club/uploads/1/3/0/6/130640232/ae9dde164.pdf
    • http://mail.thecbhsa.org/uploads/1/3/0/2/130272355/wepid.pdf
    • http://atombeauty.com/uploads/1/3/0/2/130273845/5104359.pdf
    • http://drfilldental.com.au/uploads/1/3/0/2/130272381/jetiver_lajuterizadid_dezafipimo.pdf
    • http://www.mygvhs.com/uploads/1/3/0/5/130588201/2c576a2.pdf
    • http://dianewrightdesigns.com/uploads/1/3/0/9/130969357/9ebe8fd1f.pdf
    • http://agostomiglia.com/uploads/1/3/0/9/130969415/130969415.html#www.pdf+to+word+converter+online+free
    • http://www.landseerproperties.net/uploads/1/3/0/7/130775589/jokusa

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002f3d.bin
6784a3f237fa57adbfde6c74edfb579f37ee876d9b7f2ec6e1454effb514ab39		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2F3D 7624 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.