Malicious PDF — malware analysis report

Static analysis result for SHA-256 90678ad3f79507df…

MALICIOUS

PDF

57.4 KB Authoring application: PDF Studio
MD5: aaf7820adad4a958e2d6c3ec3410ab6d SHA-1: 22fb1fc8d0a66c731eb144ce4f877c7f2c12de29 SHA-256: 90678ad3f79507df8f776c7c1dee8b6f59db552af5f808083b10ffae4025100c
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links to external PDF files hosted on various domains. This behavior is indicative of SEO spam or a phishing campaign designed to redirect users to malicious content. The ClamAV detection and ML classifier further support its malicious nature.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://asavagewedding.com/uploads/1/3/0/5/130543279/0a9ff10b2.pdf
    • http://djrockyjr.stream/uploads/1/3/0/3/130323602/2237832.pdf
    • http://trialhunter.com/uploads/1/3/0/6/130603709/2432127.pdf
    • http://bsb-novels.com/uploads/1/3/0/2/130287989/78a2d0d.pdf
    • http://belkran-bk.com/uploads/1/3/0/3/130379150/rusiked_detuganir_jujim_kiroji.pdf
    • http://74-123-76-142.mgwnet.com/uploads/1/3/0/4/130488114/ruvijuxafiw.pdf
    • http://platteparkchurch.org/uploads/1/3/0/6/130621651/vezeredetave-zilitox-vemagifa-nazibabikelodot.pdf
    • http://www.gjemporium.shop/uploads/1/3/0/3/130379222/danokulenamiwiwonut.pdf
    • http://weeknightworkout.com/uploads/1/3/0/5/130540585/gadojugegez-nurupoxim-tugovojorewi-kewetal.pdf
    • http://catalinacasa.com/uploads/1/3/0/5/130546803/kivenifaniwa_fonagilapis.pdf
    • http://fireplacewhisperer.com/uploads/1/3/0/3/130312929/049fa6329fb3.pdf
    • http://kateycrews.org/uploads/1/3/0/5/130588885/8324328.pdf
    • http://tracygrayart.com/uploads/1/3/0/6/130620849/dff4c845f48748.pdf
    • http://clinicalcampus.com/uploads/1/3/0/5/130541641/melevadanoguwiw.pdf
    • http://www.oxanalinux.net/uploads/1/3/0/9/130969475/2f186b.pdf
    • http://wkapparel.com/uploads/1/3/0/7/130738548/8169015.pdf
    • http://www.oceancitybeachphotography.com/uploads/1/3/0/9/130969885/biwanuju-zunalavujov-wujavur.pdf
    • http://nethandilin.fo/uploads/1/3/0/6/130640163/3d312f9507a46e.pdf
    • http://mrwhitchermath.com/uploads/1/3/0/8/130814515/8734458.pdf
    • http://charismasifferman.com/uploads/1/3/0/6/130603710/1783043.pdf
    • http://bob-parketon.pleasingfood.com/uploads/1/3/0/2/130270793/5882860.pdf
    • http://andresbeatstore.com/uploads/1/3/0/8/130813769/61b8f4133c7b9af.pdf
    • http://wagenselleryoga.com/uploads/1/3/0/9/130968968/130968968.html#assertive+communication+practice+exercises

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000137a.bin
d46a02d0f88096f88453657df708fcc2b7d3e2371db46ee006fe0201e0bef0bc		 pdf-font-stream PDF embedded font (sfnt) at offset 0x137A 8172 bytes
font_01_sfnt_off00009d2b.bin
41d5c9cb4d60b7530e3cfd93a78efd430fe179aa57a8296e74fb8a971da4b0ee		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9D2B 2600 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.