Malicious PDF — malware analysis report

Static analysis result for SHA-256 96bb49b83e31e19c…

MALICIOUS

PDF

46.2 KB Authoring application: Adobe PDF Library 9.0
MD5: 9745a9a4b5fb32a862e7767557932248 SHA-1: 2d33c5cd3545bf982203618964ba50c710e06ca0 SHA-256: 96bb49b83e31e19c34adb4b805d962eb1404d99f878fcd132d922418d615bd11
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded links, identified by the PDF_SEO_LINK_FARM heuristic, pointing to various domains. This suggests a phishing or redirection attack aimed at leading users to potentially malicious content. The ClamAV detection and ML classifier further support the malicious nature of the file. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://movethemortgage.com/uploads/1/3/0/3/130323603/xomekewiwifik_modajixegataza.pdf
    • http://completehandymaninparis.com/uploads/1/3/0/3/130323423/rapubozi_bawopawijibit_gitesofomufo_duzanesarofu.pdf
    • http://v2leadership.com/uploads/1/3/0/6/130639815/senizik.pdf
    • http://carrouselmuseum.net/uploads/1/3/0/2/130291975/xofonowurulusenuw.pdf
    • http://mommyandbee.com/uploads/1/3/0/6/130639913/kaviluwo.pdf
    • http://mindfullyliving.net/uploads/1/3/0/7/130740187/1820e929d.pdf
    • http://bijoumoscow.com/uploads/1/3/0/7/130775241/914c9f6b2183d5.pdf
    • http://aclarkphotography.com/uploads/1/3/0/2/130288318/6071874.pdf
    • https://bigujoxamesafeg.weebly.com/uploads/1/3/0/5/130588617/volumelomeniludil.pdf
    • http://bernardobellostudio.com/uploads/1/3/0/6/130621194/130621194.html#ohsas+18001+pdf+indonesia

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001219.bin
0809093f45c8202458c2936be300cf80245790725a4f39ab0a074dfe71643c46		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1219 7792 bytes
font_01_sfnt_off00006d22.bin
c7143368894299a997ed09f05024df052d964886bc902d598de4a6791c50751f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6D22 10292 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.