Malicious PDF — malware analysis report

Static analysis result for SHA-256 ab7588a3a010c1f7…

MALICIOUS

PDF

39.0 KB Authoring application: Poppler-utils
MD5: 2add9fb166e2782dc6fadf77300b0ee7 SHA-1: e17edfc8a315b5a4da87003aa5abf95f0743c484 SHA-256: ab7588a3a010c1f74972aa42cee38049c40c78787c0c931a42d5f4067ea4256c
152 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The PDF contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic. The ML classifier and ClamAV also flagged this as malicious, specifically as phishing or a traffic redirection tool. The embedded URLs point to numerous PDF files, suggesting a coordinated effort to distribute content or redirect users, likely for malicious purposes such as phishing or SEO spam.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.hawaiigetawayweddings.com/uploads/1/3/0/4/130483564/lavoveroleko-berosutekonef-rigave.pdf
    • http://studentsmentalhealth.net/uploads/1/3/0/3/130323936/vilodaribed-muwisoponudek-roweka.pdf
    • http://beesbizz.com/uploads/1/3/0/2/130271217/2e5eba6be54c0.pdf
    • http://nationalvisionboardday.com/uploads/1/3/0/7/130776074/a21eca750.pdf
    • http://alisonhehir.com/uploads/1/3/0/6/130605307/7222021.pdf
    • http://richardbrunst.com/uploads/1/3/0/3/130323181/7591738.pdf
    • http://mriserhoff.com/uploads/1/3/0/6/130639743/kajepojokidub.pdf
    • http://marcusthibodeau.net/uploads/1/3/0/3/130313186/6820798.pdf
    • http://monstacartoons.com/uploads/1/3/0/6/130639540/nolukefegegab.pdf
    • http://heicai3dzhuanjiayuce.f18.ebkf.org/uploads/1/3/0/7/130776564/fagafuzokosokatut.pdf
    • http://conwayduilawyer.com/uploads/1/3/0/7/130739488/d46bef.pdf
    • http://tandlakaremartin.com/uploads/1/3/0/5/130544390/9595088.pdf
    • http://flintcaucus.com/uploads/1/3/0/5/130551050/fowubaxosulu.pdf
    • http://morellicup.com/uploads/1/3/0/7/130775640/57d653f5024e1.pdf
    • http://msidec.com/uploads/1/3/0/7/130740356/mozorimukukobot-lageru-danosasovivovut-lejalofepatane.pdf
    • http://elciruelo.org/uploads/1/3/0/4/130490245/47cabb51f34.pdf
    • http://2apples2oranges.com/uploads/1/3/0/5/130551405/xawotefoda.pdf
    • http://biking4life.org/uploads/1/3/0/5/130539553/db631bb3255.pdf
    • http://coopersflamethrower.com/uploads/1/3/0/5/130550785/lujesa.pdf
    • http://legatuscultureco.com/uploads/1/3/0/7/130776808/9505585.pdf
    • http://leanqueen.co.uk/uploads/1/3/0/6/130605347/mizuvifajakizo.pdf
    • http://tonicoindio.com/uploads/1/3/0/5/130550855/76f25.pdf
    • http://shesabadassmama.com/uploads/1/3/0/4/130476514/fopiv-wuzexerepufamov.pdf
    • http://northcoastfoodtours.com/uploads/1/3/0/6/130640027/wexozelojizomujopuk.pdf
    • http://motomomfuel.com/uploads/1/3/0/7/130775308/42969d7.pdf
    • http://podollanportal.devsite-1.com/uploads/1/3/0/2/130288439/130288439.html#acls+algorithm+2017+ppt
    • http://morellicup.com/uploads/1/3/0

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003246.bin
70dd19086eb8818e59463cf2f277a078a8a60ffc0246f9fdc5f49db000c63379		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3246 8556 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.