Malicious PDF — malware analysis report

Static analysis result for SHA-256 9d8cb4ba6a903e64…

MALICIOUS

PDF

38.4 KB Authoring application: pstoedit
MD5: f23081d6de513482cb2ad0992e3336d2 SHA-1: 43365c4d02effd021e57a43cdf53b187962f175a SHA-256: 9d8cb4ba6a903e64139753b0b19a9bcb588bf5b5c8ec75b78046c372ac43c932
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF file was flagged by multiple heuristics, including a critical finding for a link farm and ClamAV detection as phishing malware. The ML classifier also assigned a high probability of maliciousness. The document body, though partially corrupted, appears to be a lure related to mortgage calculators, which is a common theme in financial phishing scams. The embedded URLs likely lead to further malicious content or phishing pages.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://moonlightairfoundation.org/uploads/1/3/0/5/130588531/da03bfeba.pdf
    • http://sharenicely.com/uploads/1/3/0/6/130639561/921677.pdf
    • http://teambtl.com/uploads/1/3/0/7/130738629/nipufimilino-kujituw.pdf
    • http://pleasantgreenmethodist.org/uploads/1/3/0/6/130620228/d9822.pdf
    • http://hostmaster.noviacommunicatie.nl/uploads/1/3/0/2/130292104/2608542.pdf
    • http://nmnawgj.com/uploads/1/3/0/6/130605133/b041c1fbd09326.pdf
    • http://mickeyinminutes.net/uploads/1/3/0/8/130873825/648168.pdf
    • http://coachs7375.com/uploads/1/3/0/3/130312926/vumorigik.pdf
    • http://niram.com/uploads/1/3/0/5/130589122/5317473.pdf
    • http://arcobalenouk.com/uploads/1/3/0/8/130814100/3844392.pdf
    • http://rockvilleintegrativetherapist.com/uploads/1/3/0/4/130483847/2991618.pdf
    • http://bigwalkies.com/uploads/1/3/0/7/130776474/zevunutudanapibubed.pdf
    • http://webdisk.rashidacostaauthor.com/uploads/1/3/0/9/130969623/makowamojelufobusav.pdf
    • http://qutisatelier.com/uploads/1/3/0/4/130476688/a32c0dc.pdf
    • http://assurdrive.net/uploads/1/3/0/6/130621374/vofaroza.pdf
    • http://cosysock.club/uploads/1/3/0/2/130288523/bixukolure.pdf
    • http://www.ristorantebenedetto.it/uploads/1/3/0/5/130541133/0b0bdeab5e7a7.pdf
    • http://candeelandproductions.com/uploads/1/3/0/3/130379428/8315350.pdf
    • http://britfinds.com/uploads/1/3/0/3/130313700/zewiz_maxadobonubem.pdf
    • http://derekcroucher.co.uk/uploads/1/3/0/5/130546937/14f3861c49e8695.pdf
    • http://saccma.org/uploads/1/3/0/7/130774977/77d1316250fd1d.pdf
    • http://www.tahairyt.com/uploads/1/3/0/6/130639701/c2cf3a07.pdf
    • http://sam-tisher-senio-1.rominastiebenphotography.com/uploads/1/3/0/9/130969761/130969761.html#biweekly+mortgage+calculator+amortization+table
    • http://saccma.org/u

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003408.bin
4aa4914e972a197bfbd1991dc822a5c01a1621fff5561aced4a1dfd49178695f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3408 8112 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.