Malicious PDF — malware analysis report

Static analysis result for SHA-256 a37268cca85c7857…

MALICIOUS

PDF

44.1 KB Authoring application: Smallpdf Desktop
MD5: 2bd5b201d0a8e8b065f79f87a6c4ed02 SHA-1: ad129cf19f2c66a09918e6a267375a6b8327a444 SHA-256: a37268cca85c78579c97b2f302c8c47ea6033027a20a4eba00837b3ef3e5cc98
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a lure related to 'baby stomach measuring large on ultrasound' to entice users to click on embedded links. The heuristic 'PDF_SEO_LINK_FARM' indicates that the document contains a large number of external PDF links, with the primary domain being thinktwicefilms.com. This suggests a phishing or redirection campaign aiming to lead users to malicious content hosted across multiple domains.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://thinktwicefilms.com/uploads/1/3/0/4/130488500/053e1.pdf
    • http://premierdraftroofing.com/uploads/1/3/0/5/130551081/7c2dc3df.pdf
    • http://rehphotography.org/uploads/1/3/0/5/130588675/lujagil.pdf
    • http://nomadicmichelle.com/uploads/1/3/0/5/130542859/zamaz.pdf
    • http://nuditosytrapitos.com/uploads/1/3/0/4/130489128/kevurigumoxis.pdf
    • http://southenddiving.co.uk/uploads/1/3/0/5/130590367/vinemoji.pdf
    • http://sudoxod.com/uploads/2020/01/28/3421874.pdf
    • http://notestotheunderground.com/uploads/1/3/0/5/130539085/wozadulufewoxuze.pdf
    • http://thehappygirlstore.com/uploads/1/3/0/6/130639175/130639175.html#baby+stomach+measuring+large+on+ultrasound

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000011a0.bin
0843c25ad2c628e16a12e89604ba32f2b032d781c0f721421a4d823f5d12f0ba		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11A0 8328 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.