Malicious PDF — malware analysis report

Static analysis result for SHA-256 c37821a0be58475f…

MALICIOUS

PDF

55.0 KB Authoring application: Solid Converter PDF
MD5: f704328ee66b6f71b47aa3c53538644f SHA-1: 4b73c82e1728934e719c3f88bb5f408736d9dd2e SHA-256: c37821a0be58475f582fa73fc83275e917eeb73be576e060112c4865024d3276
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of external links, as indicated by the PDF_SEO_LINK_FARM heuristic. The embedded URLs are predominantly to external PDF files hosted on various domains, suggesting a link farm or redirection strategy. The ML classifier and ClamAV detection further support the malicious nature of the file, classifying it as phishing-related. No scripts were extracted, and the document body content is heavily obfuscated and contains irrelevant text.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://mrsjessinaanderson.com/uploads/1/3/0/2/130288317/bidemete.pdf
    • http://myprizeonline.com/uploads/1/3/0/3/130323291/votipukozader-polesizi-panojuvufopija.pdf
    • http://millerspowdercoating.com.au/uploads/1/3/0/6/130621303/770da0c71bbfa.pdf
    • http://phsmostl.com/uploads/1/3/0/4/130475923/denikejoberaxad_malizuwax.pdf
    • https://wuzosijufereri.weebly.com/uploads/1/3/0/6/130604702/6734747.pdf
    • http://movingbeyondyoga.com/uploads/1/3/0/4/130477663/pojekapapiduwizoka.pdf
    • http://multifaithstorytelling.org/uploads/1/3/0/6/130621369/420110ec6265d67.pdf
    • http://michaelshusko.com/uploads/1/3/0/5/130588802/130588802.html#sona+bondhu+re+audio+song

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000118e.bin
954faf3690036d8a4393c6059b9fd341aac9264a78e16891c663d819d5795ddc		 pdf-font-stream PDF embedded font (sfnt) at offset 0x118E 7964 bytes
font_01_sfnt_off0000673d.bin
378288d3133907284a1dd708aec606fa45674349f7e67e9eaedc79a8f6af9139		 pdf-font-stream PDF embedded font (sfnt) at offset 0x673D 16228 bytes
font_02_sfnt_off00007c50.bin
1723f1ced37cc89d69e30f3df6281c5e5fb8989544fd4587aa75b00c91af2fd0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7C50 1388 bytes
font_03_sfnt_off000084d8.bin
ede1a17bb21dea9eacdf8245b72af1b17540ff98bfbb8e585a703f63c0d553d5		 pdf-font-stream PDF embedded font (sfnt) at offset 0x84D8 12188 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.