Malicious PDF — malware analysis report

Static analysis result for SHA-256 b78b47c4f82c480b…

MALICIOUS

PDF

34.7 KB Authoring application: SWFTools
MD5: bb5b8c50d50916f6f35b73418eff0009 SHA-1: 6e4924b75c2041fba59cfcfbc3261dfd5f68bcb7 SHA-256: b78b47c4f82c480bbd478d3ea5b379f46fe7f7214ae1a026763636f6db2e21de
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF contains a large number of embedded URLs pointing to other PDF files, a technique commonly used for SEO poisoning and phishing. The document body attempts to lure the user by offering a 'study guide free download', which is a common pretext for distributing malicious content. The ClamAV detection and ML classifier strongly indicate malicious intent, likely related to phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ajhollowayministries.com/uploads/1/3/0/5/130540453/9d081c016dee1fd.pdf
    • http://blazeon.ca/uploads/1/3/0/3/130323656/1709506.pdf
    • http://midwest-grow.com/uploads/1/3/0/5/130551191/tazurakelap_masoviku_xajafuvejaw_xubirotizo.pdf
    • http://menthings.net/uploads/1/3/0/4/130476276/a061e.pdf
    • http://aiselementary.com/uploads/1/3/0/5/130547150/zegawuta.pdf
    • http://bakergl.com/uploads/1/3/0/7/130738666/7194785.pdf
    • http://porntaza.com/uploads/1/3/0/2/130289690/4a72a2fc86.pdf
    • http://pressburg-partners.com/uploads/1/3/0/7/130740504/3174a79.pdf
    • http://freehombre.com/uploads/1/3/0/6/130640194/5528343.pdf
    • http://epq.stwilfrids.com/uploads/1/3/0/7/130775373/33d252bf3523.pdf
    • http://titosfiestamexicana.com/uploads/1/3/0/4/130489066/jevotopu-tixumiluxadu.pdf
    • http://mirabellchicago.com/uploads/1/3/0/7/130775651/majudu.pdf
    • http://grillou.fr/uploads/1/3/0/7/130776808/130776808.html#acls+study+guide+free+download
    • http://grillou.fr/uploads/1/3/0/7/1307768

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002f96.bin
26623c31b4438f17cd99f104e3a4c6b4f482c62f9c4b0ad39f124249e8d434a4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2F96 8048 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.