Malicious PDF — malware analysis report

Static analysis result for SHA-256 9cc537e3e5b64fed…

MALICIOUS

PDF

32.5 KB Authoring application: QPDF
MD5: 2cbc8fbabea9c1f4b6999c60d832b422 SHA-1: f3790fbc5b1c3ed2851137da1fa314a6a04cab93 SHA-256: 9cc537e3e5b64fed5a55593ccd820a5390023c319fd25866bdc63342a913167f
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded external links, as indicated by the PDF_SEO_LINK_FARM heuristic. The ClamAV detection and ML classifier also strongly suggest malicious intent. The primary goal appears to be SEO manipulation or directing users to a large collection of other PDF files, which could be used for phishing or distributing further malware. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.jayworks.org/uploads/1/3/0/6/130620468/nirijunejanoretev.pdf
    • http://pittsburghgoldbuyers.com/uploads/1/3/0/2/130288673/kepanigerimi-kagowowut-xonawemotibuzod-jemiza.pdf
    • http://ilgrandegiorno.com/uploads/1/3/0/3/130323616/vozamufozudoma.pdf
    • http://www.gollygoshgifts.com/uploads/1/3/0/4/130476984/48130.pdf
    • http://benkinney.org/uploads/1/3/0/5/130551390/5133858.pdf
    • http://bracelets-and-rings.com/uploads/1/3/0/6/130604548/fusejalol.pdf
    • http://interstructceilings.com/uploads/1/3/0/6/130620573/649d4eb10.pdf
    • http://mistykwilliams.com/uploads/1/3/0/4/130476523/5642184.pdf
    • http://www.nullaginecrc.net/uploads/1/3/0/7/130776484/c2db0ca7ad2.pdf
    • http://brewery-safety.com/uploads/1/3/0/2/130272080/1cf79.pdf
    • http://positiveworldaccelerator.com/uploads/1/3/0/6/130639775/7465165.pdf
    • http://suredoneservices.com/uploads/1/3/0/6/130639703/b57c32.pdf
    • http://recallcathy.com/uploads/1/3/0/6/130622095/9683975.pdf
    • http://www.asiavegantravel.com/uploads/1/3/0/5/130541846/wumusefadez.pdf
    • http://zumecareers.com/uploads/1/3/0/5/130590235/6360971.pdf
    • http://yw4ez.bpmtc.com/uploads/1/3/0/5/130588716/130588716.html#solving+non+homogeneous+differential+equations+in+matlab

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002325.bin
82f465cb7d3c1756eef2037753c47ce1955fb32a90b6ea8ba7bb600028aeba43		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2325 8088 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.