Malicious PDF — malware analysis report

Static analysis result for SHA-256 9a6a5604e6eec44e…

MALICIOUS

PDF

33.9 KB Authoring application: Nitro PDF
MD5: 371e4d670fe4c1298860e5cf2495dd28 SHA-1: 224eeb9f42f0954b8ee85db1c3969e2f722e31f8 SHA-256: 9a6a5604e6eec44e7ebee28e656c3294ea6a998f53f2a2970188255c2a6fd638
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded external links, as indicated by the PDF_SEO_LINK_FARM heuristic. The ClamAV detection and ML classifier also flagged this file as malicious, specifically as phishing-related. The embedded URLs suggest a tactic to drive traffic to potentially malicious or SEO-manipulated content. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://wildlifegardener.org/uploads/1/3/0/3/130313086/bibubiwevu.pdf
    • http://lostpupper.club/uploads/1/3/0/4/130493816/sobizodukuxexu-wodorabez.pdf
    • http://fountainalleybodycare.com/uploads/1/3/0/5/130589285/1973722.pdf
    • http://morrismanagementinc.com/uploads/1/3/0/6/130640022/1876394.pdf
    • http://www.partnersinclinicaldiscovery.com/uploads/1/3/0/9/130969182/pulupidupitinug.pdf
    • http://tutorloft.com/uploads/1/3/0/5/130544953/libipuwiwesazuj.pdf
    • http://zygoptera.org/uploads/1/3/0/7/130776821/waxiwunenefusun_kevafotebazaz.pdf
    • http://rolandv.net/uploads/1/3/0/7/130776099/jenopozezetuju.pdf
    • http://newmexicomade.com/uploads/1/3/0/2/130272390/030d67.pdf
    • http://aimeelora.com/uploads/1/3/0/5/130588574/2c6034.pdf
    • http://citymarketescaperoom.com/uploads/1/3/0/6/130620792/3348151.pdf
    • http://mycubbylife.com/uploads/1/3/0/7/130776148/2f00755f.pdf
    • http://jjsholdings.net/uploads/1/3/0/4/130489072/warilitixenotamiwodu.pdf
    • http://juliancert.com/uploads/1/3/0/6/130620873/9801587.pdf
    • http://ranjwrites.com/uploads/1/3/0/5/130590403/nukizaxomi.pdf
    • http://dr-arturo-pittman.pleasingfood.com/uploads/1/3/0/6/130621940/130621940.html#agradecimientos+de+tesis+a+mi+familia+pdf
    • http://mycubbylife.com/uploads/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002d5e.bin
22dfe1117049f23f75fd5848c4d05876211f6fcfb5c1d26264639f3319b6ef97		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2D5E 7180 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.