Malicious PDF — malware analysis report

Static analysis result for SHA-256 a24c3a24c406d53d…

MALICIOUS

PDF

37.3 KB Authoring application: Soda PDF
MD5: c4610770773f15fd9284ffb18ef47e59 SHA-1: edd2fbd873d3afd2e7250e137a2cd54c75a06d66 SHA-256: a24c3a24c406d53d85e0f76356186b0f8079847c36054d15b7aed638e9ed95ef
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF contains a large number of embedded external links, a technique often used for SEO poisoning or to redirect users to malicious sites. ClamAV detected this as 'Pdf.Phishing.TtraffRobotInstall-7605656-0', indicating a phishing or traffic redirection purpose. The ML classifier also strongly flagged it as malicious. The embedded URLs likely lead to further stages of infection or phishing attempts.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://riccijustisart.com/uploads/1/3/0/5/130589159/0e849928f6.pdf
    • http://ketocoacher.com/uploads/1/3/0/5/130551176/gotuxosijo.pdf
    • http://lanwanwireless.net/uploads/1/3/0/7/130738960/bobisudineb.pdf
    • http://www.goldsealel.com/uploads/1/3/0/3/130379293/abdc91b.pdf
    • http://wannarun.com/uploads/1/3/0/7/130739755/4676080.pdf
    • http://politicskilleen.org/uploads/1/3/0/6/130604632/7e087c848171.pdf
    • http://andrewportwood.com/uploads/1/3/0/2/130288310/5474183.pdf
    • http://www.benbernous.com/uploads/1/3/0/6/130621603/bunatasika_maperudo_mogadigatexu.pdf
    • http://moietydirect.com/uploads/1/3/0/7/130740013/863152.pdf
    • http://dekastanje.nl/uploads/1/3/0/7/130739459/tukutebutedisi_vajagusowijis_xirojosutat.pdf
    • http://dionysi.com/uploads/1/3/0/4/130489361/e88fd0599987d.pdf
    • http://sonsandbrothers.com/uploads/1/3/0/3/130313433/wadixawagiralazupiki.pdf
    • http://aronstubbins.com/uploads/1/3/0/2/130272342/vineze_lufagi_timarixar_zoxifibak.pdf
    • http://southernangelboutique.net/uploads/1/3/0/2/130274338/8960438.pdf
    • http://huskercarwash.com/uploads/1/3/0/8/130814195/fobito.pdf
    • http://holypost.us/uploads/1/3/0/4/130477234/demezoje.pdf
    • http://overtimetheplay.com/uploads/1/3/0/4/130476262/974794.pdf
    • http://xinleyuanyulecheng.br3h.com/uploads/1/3/0/7/130739756/130739756.html#gist+tumor+bone+metastasis
    • http://www.benbernous.com/upl

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000035f6.bin
094899588012bcf4d268a7d35abe31020e9d18af4c640b1d7702b110d933f52a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x35F6 7672 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.