Malicious PDF — malware analysis report

Static analysis result for SHA-256 c0e3537591f70638…

MALICIOUS

PDF

36.9 KB Authoring application: PDF Studio
MD5: dab8b230086efec7699b90526366936d SHA-1: ff692e6464e11171686cb10fbcf1bfdeba85dd3a SHA-256: c0e3537591f706382c425a985299a95b6d7aee8d7c907d8b1675d5ce8c94849c
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded external links pointing to other PDF files across numerous domains. This behavior is indicative of a link farm or a distribution mechanism for malicious content, as suggested by the 'PDF_SEO_LINK_FARM' and 'ML_NYX_PDF_MALICIOUS' heuristics. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a phishing or traffic redirection intent. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.fishingitforwardmichigan.com/uploads/1/3/0/7/130740053/3993077.pdf
    • http://allatjanster.online/uploads/1/3/0/7/130776368/zilubute_razedufuluxexu.pdf
    • http://phoenixdice.shop/uploads/1/3/0/5/130543543/zeserakogate.pdf
    • http://www.ghalebi.org/uploads/1/3/0/5/130542875/8b67ba5ce28b1b.pdf
    • http://www.fabfiveeagles.com/uploads/1/3/0/5/130589223/1e4f22.pdf
    • http://norecordsnobs.com/uploads/1/3/0/4/130478210/xusixiromevuxokeg.pdf
    • http://stacyinexile.com/uploads/1/3/0/6/130621352/walasolumiwe.pdf
    • http://liftuplab.com/uploads/1/3/0/4/130476873/7077641.pdf
    • http://www.americansprinklercompany.com/uploads/1/3/0/4/130476908/f7b9a7415c.pdf
    • http://bearsvbabiesgame.net/uploads/1/3/0/6/130621281/286af3.pdf
    • http://www.warriortrail212.com/uploads/1/3/0/6/130604620/zifufumap_jinunixa_texexososo.pdf
    • http://limitlesslawnsprinklers.com/uploads/1/3/0/6/130605490/lijuba_wetodavu_toton.pdf
    • http://retrobathandbody.net/uploads/1/3/0/7/130739564/xuragugogorugi.pdf
    • http://te-alton.com/uploads/1/3/0/7/130774981/5772656.pdf
    • http://desertsageptsa.com/uploads/1/3/0/5/130544303/lotot.pdf
    • http://mail.carnielittlefield.com/uploads/1/3/0/6/130639504/wakolizunabivok_fogikipujej_webawesodezip_mijelomafeza.pdf
    • http://74-123-73-178.mgwnet.com/uploads/1/3/0/4/130477193/130477193.html#printable+colouring+pages+for+christmas
    • http://stacyinexile.com/uploads/1/3/0/6/130621

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003525.bin
035454ca86bc45ff0ae8e5e47e0f5d1a134c390b6a2c02dd395bd7ef5c944ace		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3525 7536 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.