Malicious PDF — malware analysis report

Static analysis result for SHA-256 99de5f6d14fb5d74…

MALICIOUS

PDF

39.1 KB Authoring application: PDFedit
MD5: daa7468c40a5fd907573f0a1fa74caf9 SHA-1: f28c644203fb775d863383726596f767c53c345a SHA-256: 99de5f6d14fb5d743d9a3211191f32a6be5ad98bb5101c5f36d542b8a10d46a3
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded URLs pointing to other PDF files, a technique often used for SEO manipulation or to distribute further malicious content. The ClamAV detection and ML classifier strongly indicate malicious intent. The embedded URLs are the primary IOCs, suggesting a link farm or redirection strategy.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://konnektuk.com/uploads/1/3/0/3/130313468/kinamuvo.pdf
    • http://missiontanks.com/uploads/1/3/0/6/130622120/jukofefo.pdf
    • http://scentedpens.com/uploads/1/3/0/3/130323151/jepazik.pdf
    • http://mokapuelem.org/uploads/1/3/0/3/130379514/4919400.pdf
    • http://shcdesignsllc.com/uploads/1/3/0/3/130323789/13044f78ac5.pdf
    • http://nycaffordablehousing.org/uploads/1/3/0/2/130272254/5049536.pdf
    • http://modimody.com/uploads/1/3/0/7/130739690/bokifozebojevax-sozijiwofivupef-ravabobaruzik.pdf
    • http://po4gen.org/uploads/1/3/0/5/130543261/9bfd8591.pdf
    • http://inboundtrain.net/uploads/1/3/0/4/130476721/3171717.pdf
    • http://merkabaonecollection.com/uploads/1/3/0/7/130775540/babes.pdf
    • http://www.rgb-mods.com/uploads/1/3/0/6/130639580/tubuvo_molumupe.pdf
    • http://thepurposeprofessor.com/uploads/1/3/0/4/130477083/e809ea911.pdf
    • http://collabra-nation.com/uploads/1/3/0/6/130621700/zeginaxovokodo.pdf
    • http://kitchencocktails.net/uploads/1/3/0/4/130483384/eb4b1df8c8.pdf
    • http://rikatsutsui.com/uploads/1/3/0/2/130270847/votetiguse_jokixop.pdf
    • http://petahuk.store/uploads/1/3/0/7/130738512/revukudokaxo.pdf
    • http://walteralbertglobal.com/uploads/1/3/0/7/130740062/3242508.pdf
    • http://butterboutique.org/uploads/1/3/0/5/130550721/nebisuluvujezof.pdf
    • http://corvidaewines.com/uploads/1/3/0/5/130540211/f0a58.pdf
    • http://www.albecoinstitute.com/uploads/1/3/0/6/130640023/nokelefokupimifu.pdf
    • http://www.dudleyneighborsinc.org/uploads/1/3/0/4/130483253/kitisogoz_nifemadimenifix_riwarevebimi_zilalidi.pdf
    • http://robinsonbasketball.com/uploads/1/3/0/6/130604935/3229470.pdf
    • http://cyberaffairs.com/uploads/1/3/0/5/130551749/958248.pdf
    • http://owa.bhberg.co.za/uploads/1/3/0/8/130874153/bb5b491f.pdf
    • http://host244.carmichaelnl.com/uploads/1/3/0/7/130738871/130738871.html#adding+and+subtracting+integers+using+counters+worksheets
    • http://rikatsutsui.com/uploads/1/3/0/2/130270

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003445.bin
b3e5a89e33198395ef59603e936b0292d565950538be27a393bb75c6e6fb570b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3445 8292 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.