Malicious PDF — malware analysis report

Static analysis result for SHA-256 be682f7657393b55…

MALICIOUS

PDF

50.5 KB Authoring application: Pdftk
MD5: 9d4b377a5906b132dc78783bcdeba58c SHA-1: 57fd1338eaba520fd1d0f71322990bc921585f6a SHA-256: be682f7657393b55872f29513d7b1afebeac07a5f17ccf511fae2f7bbee26cf0
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links to external PDF files hosted on various domains, as indicated by the PDF_SEO_LINK_FARM heuristic. This suggests a tactic to manipulate search engine results or distribute malicious content. The ML classifier and ClamAV detection strongly support its malicious nature, classifying it as phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ineavet.com/uploads/1/3/0/5/130550664/7197190.pdf
    • http://lonlelyphotographer.online/uploads/1/3/0/7/130775974/fejapodo.pdf
    • http://mjrblogspot.com/uploads/1/3/0/4/130435726/9683179.pdf
    • http://heidiimmler.com/uploads/1/3/0/6/130604708/02a7d0e8.pdf
    • http://www.drsmartphonesfc.com/uploads/1/3/0/6/130621376/c361e20d379.pdf
    • http://farber.ca/uploads/1/3/0/6/130621909/mamozesinojun_negadomogu_sedux_momemawaj.pdf
    • http://deannapaulsen.com/uploads/1/3/0/7/130776754/xekoxafaruwilik-xozudixabif-bivuvedija-vozigi.pdf
    • http://espaijove.info/uploads/1/3/0/6/130620751/7ffd75de7b8eee5.pdf
    • http://somersetfoodtrail.org/uploads/1/3/0/3/130313176/9362902.pdf
    • http://annearundelhandcenter.com/uploads/1/3/0/5/130543155/4702503.pdf
    • http://paddlebp.com/uploads/1/3/0/3/130323400/pekugolole-vopezedowekus.pdf
    • http://lafamiliaojeda.net/uploads/1/3/0/2/130274091/pulubod.pdf
    • http://mmorrisld.com/uploads/1/3/0/3/130313345/gitabevukiwixisol.pdf
    • http://nlwatercolor.net/uploads/1/3/0/3/130313122/2542700.pdf
    • http://estoreone.net/uploads/1/3/0/3/130313398/fesix.pdf
    • http://atrendyblogwithmeg.com/uploads/1/3/0/3/130323174/6258714.pdf
    • http://autosafenow.com/uploads/1/3/0/4/130488759/ba9099.pdf
    • http://silktailor.ca/uploads/1/3/0/8/130814052/kovewor.pdf
    • http://huangjiayulezhinan.br3h.com/uploads/1/3/0/7/130776415/130776415.html#learning+tenses+in+english+grammar+in+hindi

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000046a6.bin
1723f1ced37cc89d69e30f3df6281c5e5fb8989544fd4587aa75b00c91af2fd0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x46A6 1388 bytes
font_01_sfnt_off00004e78.bin
d179794f61ac35fd4f3d72a9fe8d180b1530b28c1c369e3f8418ed3686703cfd		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4E78 8944 bytes
font_02_sfnt_off000068f0.bin
df78384e942b96a48e24bd94c9b3ffd492b93cd1b3a9f65da6c307d3258b1ecc		 pdf-font-stream PDF embedded font (sfnt) at offset 0x68F0 7796 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.