Malicious PDF — malware analysis report

Static analysis result for SHA-256 91256d09160bcc70…

MALICIOUS

PDF

34.6 KB Authoring application: Nitro PDF
MD5: d5455eea2e6663bd31e6c8e7b1f7be78 SHA-1: 8f47fe874b9e6c14d8cdc40d34161dad457cc796 SHA-256: 91256d09160bcc7056f0eafba6d0e5bde9ac0d2c59b3b1e2f9f33c5b7d7c9c80
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded links to external PDF documents, a technique commonly used for SEO poisoning or to redirect users to malicious content. The ClamAV detection and ML classifier strongly indicate malicious intent. The heuristic 'PDF_SEO_LINK_FARM' specifically identifies the mass external PDF link farm, with the first URL being http://creations2delite.com/uploads/1/3/0/5/130543190/gutikutus-musemupebake-texiwuxo.pdf. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://creations2delite.com/uploads/1/3/0/5/130543190/gutikutus-musemupebake-texiwuxo.pdf
    • http://staqual.in/uploads/1/3/0/4/130476168/wegaxetovinu-xumubogukiju-tegixike-ladesik.pdf
    • http://jantalist.net/uploads/1/3/0/7/130738939/7587c65f47ac514.pdf
    • http://gaskingadgets.com/uploads/1/3/0/4/130483384/2300416.pdf
    • http://www.filmliteracyeurope.org/uploads/1/3/0/2/130287886/vozidobo.pdf
    • http://reviewpointservice.com/uploads/1/3/0/2/130270785/bidal-mowejipukibo-boxetuxadat-miwenolepifun.pdf
    • http://nightowlsoulclubs.com/uploads/1/3/0/3/130323145/zujob_nupilov_wozumib_rumoso.pdf
    • http://bodybydrea.net/uploads/1/3/0/3/130323461/zeviwera_faxem_pegosid_pufiwoli.pdf
    • http://passionatepursuit.net/uploads/1/3/0/2/130273589/pugafoga-getepikub-vipufoj.pdf
    • http://simonassi.com/uploads/1/3/0/7/130739751/e33db.pdf
    • http://www.laurenbriggs.net/uploads/1/3/0/6/130639580/rajenimabidopojar.pdf
    • http://bandheadreunions.com/uploads/1/3/0/3/130323479/nixerorevum_worozufip_tejoditekeb.pdf
    • http://vedantchandra.com/uploads/1/3/0/7/130739633/3829864.pdf
    • http://www.cynthiapetersen.com/uploads/1/3/0/3/130313567/zebado.pdf
    • http://saranlpcoach.com/uploads/1/3/0/4/130488114/130488114.html#what+are+the+similarities+and+differences+between+capitalism+and+socialism
    • http://reviewpointservice.com/uploads/1/3/0/2/130270785/bidal-mowejipukibo-b

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002f24.bin
c2e8a28856bd2b8af7022a010f6ebf2e352b6d5900abdf47ba558a041391ae43		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2F24 7024 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.