Malicious PDF — malware analysis report

Static analysis result for SHA-256 b52bd1862335fb27…

MALICIOUS

PDF

34.5 KB Authoring application: Mobipocket Creator
MD5: f528cd4d39cf4ff5574c32e6a41ca7cc SHA-1: 5463dea3135c65c336810402a0ac918844773a81 SHA-256: b52bd1862335fb2758da3b417a30f036725470f6f4761504c058b8a1b2cc63c3
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was flagged by multiple heuristics, including ClamAV and an ML classifier, as malicious. The critical PDF_SEO_LINK_FARM heuristic indicates the presence of a large number of embedded external links pointing to PDF files hosted on various domains. This suggests a phishing or SEO spam campaign designed to redirect users to potentially malicious content. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://mindfulneuropsych.org/uploads/1/3/0/6/130604240/zudagiwaginupojo.pdf
    • http://heartsunitetheglobe.org/uploads/1/3/0/3/130379202/7157367.pdf
    • http://votened.net/uploads/1/3/0/6/130639386/dimijen.pdf
    • http://pumpkinvinecafe.com/uploads/1/3/0/2/130287896/fawowisifalo-bubojezewimoxig-potubazowufo-gazeni.pdf
    • http://anonnetwork.net/uploads/1/3/0/6/130605289/radero-samote-rigep.pdf
    • http://michaelandsydneylovepi.com/uploads/1/3/0/7/130739393/ccc863cb6.pdf
    • http://doulajane.com/uploads/1/3/0/5/130551907/2634662.pdf
    • http://thelonghornsd.com/uploads/1/3/0/3/130313004/rovupotekujideb.pdf
    • http://cemento-stampato.org/uploads/1/3/0/6/130621404/260d58.pdf
    • http://sharedtravel.voyagerwebsites.com/uploads/1/3/0/6/130621596/130621596.html#0.1m+phosphate+buffer+ph+6.8

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000011f7.bin
288aab5f9c5de806691ff556aeabc62ee1aa3e7a7e1c88937da8a281884cca79		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11F7 8008 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.