Malicious PDF — malware analysis report

Static analysis result for SHA-256 a096a44bb0f2a297…

MALICIOUS

PDF

44.5 KB Authoring application: PDFedit
MD5: c0b8ac3ff88842ca27c05888342bcd73 SHA-1: b1ab7eebbb0642a11d18efb6bfe6612dfaffee73 SHA-256: a096a44bb0f2a29707a16bf216e49326cc3e8bfbeb93a2e7b94e0648e55347ea
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

This PDF file was flagged by multiple heuristics, including a critical alert for a link farm and ClamAV detection as phishing malware. The document contains a large number of embedded URLs pointing to other PDF files, suggesting a phishing or redirection campaign. No scripts were extracted from this sample, and the document body contained mostly garbage data.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.revivalsoundstudios.com/uploads/1/3/0/5/130551206/fuxowapinaxegu-redevenobeluti-niteb.pdf
    • http://themarkstaging.com/uploads/1/3/0/7/130740573/09937f6c46b939.pdf
    • http://mooredems.com/uploads/1/3/0/6/130620834/podibusiso_wafex_rejusekuwalixo_wimubixutas.pdf
    • http://www.firefallministries.net/uploads/1/3/0/2/130289652/e44e26e8.pdf
    • http://mallard.financial/uploads/1/3/0/3/130323322/a22e64cdebc51c2.pdf
    • http://tampadivorcehelp.com/uploads/1/3/0/8/130874204/20e9e0.pdf
    • http://argamaprints.com/uploads/1/3/0/5/130541688/9d982e9.pdf
    • http://brooksfirth.com/uploads/1/3/0/7/130774966/bewufaxareginewupa.pdf
    • http://thewreckingcru.com/uploads/1/3/0/6/130621868/luzipagamebu-raxosopudaw-nanavotijap-zelumax.pdf
    • http://southamericasflowers.com/uploads/1/3/0/7/130738646/4336712.pdf
    • http://femalefinancialindependence.com/uploads/1/3/0/7/130738885/3a86b4c1695b1.pdf
    • http://amomilanoleather.com/uploads/1/3/0/4/130483759/6589314.pdf
    • http://thisisgood.org/uploads/1/3/0/6/130621048/lenoper.pdf
    • http://mobyzap.com/uploads/1/3/0/6/130639552/faa3a9.pdf
    • http://mail.jaynestringer.com/uploads/1/3/0/8/130874218/zugilimitopus.pdf
    • http://schallisflyfishing.de/uploads/1/3/0/8/130814343/4897098.pdf
    • http://nationalautomobilemuseum.org/uploads/1/3/0/6/130639309/digodavunoraxe.pdf
    • http://georgebeaumont.com/uploads/1/3/0/7/130775786/709acf7.pdf
    • http://destinationsoflove.voyagerwebsites.com/uploads/1/3/0/5/130588390/130588390.html#passive+voice+of+past+perfect+tense+in+hindi

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002c58.bin
1723f1ced37cc89d69e30f3df6281c5e5fb8989544fd4587aa75b00c91af2fd0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2C58 1388 bytes
font_01_sfnt_off00003465.bin
bcde61ecd45420224a88d1b06c71554ae2804ab9cf05accec13587861c4beb7e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3465 9876 bytes
font_02_sfnt_off00005083.bin
909fa321cc843951641c7dde2042f3ec4a990de3a7e0ae8af166c6cebacb3728		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5083 7624 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.