Malicious PDF — malware analysis report

Static analysis result for SHA-256 c3a02bc10c11b2ce…

MALICIOUS

PDF

39.1 KB Authoring application: Soda PDF
MD5: f81359e097e93f2fc4c1bbfa81499a26 SHA-1: 87dcb26a4ec1229b71cbf030c53e89c3918dc492 SHA-256: c3a02bc10c11b2ce4305f55e4c0fe93d3c4d246a86e7422dd18dcd5e70e051f7
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious File

The PDF contains a large number of embedded URLs pointing to other PDF files, a technique often used for SEO manipulation or to distribute malware. The ClamAV detection and ML classifier strongly indicate malicious intent. The heuristic 'PDF_SEO_LINK_FARM' explicitly identifies the mass external PDF link farm, with the dominant host being xb5kn.bpmtc.com.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Dropper.Agent-7889783-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Dropper.Agent-7889783-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://xb5kn.bpmtc.com/uploads/1/3/0/7/130776102/ditizef.pdf
    • http://djlion.me/uploads/1/3/0/6/130604417/82d285c42b4.pdf
    • http://brokenhartarena.org/uploads/1/3/0/3/130313786/bomebepenele.pdf
    • http://fightbite.net/uploads/1/3/0/6/130620936/lovuwol.pdf
    • http://firezoneschaumburg.com/uploads/1/3/0/6/130621272/9c9b41.pdf
    • http://moosewoodalaska.com/uploads/1/3/0/7/130739930/lutiwuworuko.pdf
    • http://costumearty.com/uploads/1/3/0/7/130739537/rezurafof_zunodu_tebalexedu.pdf
    • http://www.expertmobileblasting.com/uploads/1/3/0/5/130551754/2616474.pdf
    • http://nicolemartinetti.com/uploads/1/3/0/2/130272240/xolewenej.pdf
    • http://thumbderstruck.com/uploads/1/3/0/5/130588548/lilotiposuwigag-beguzi-duniweguv.pdf
    • http://shundorhair.com/uploads/1/3/0/8/130814205/7855914.pdf
    • http://jolenesphotography.com/uploads/1/3/0/8/130813032/gixuworepus.pdf
    • http://heckteck.com/uploads/1/3/0/3/130379675/7444273.pdf
    • http://nurseryrhymedesign.com/uploads/1/3/0/7/130776132/22b8b6bb.pdf
    • http://www.elwesal.com/uploads/1/3/0/7/130775979/0763b.pdf
    • http://northcoloradomedevac.com/uploads/1/3/0/7/130739949/jedezisijezoke-natilikisofe-gedugidopud.pdf
    • http://landmarkenglish.opole.pl/uploads/1/3/0/4/130483394/82996839ee928e.pdf
    • http://epilepsymtcourse.org/uploads/1/3/0/2/130288348/865660.pdf
    • http://primeclassutah.com/uploads/1/3/0/5/130540134/jutobotaluri.pdf
    • http://cbncertifiedbossnetwork.com/uploads/1/3/0/3/130323271/lageronifatagejike.pdf
    • http://homehotel.net/uploads/1/3/0/3/130379757/kajejurizotise-mofavonos-bomevinesaf-difajako.pdf
    • http://smarty-hotels-de.devsite-1.com/uploads/1/3/0/9/130969664/130969664.html#sworn+affidavit+sample+india

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003880.bin
1bd15e73cf4a5452d60db730cbce66d1b60e87f1f661498a0b6ab8bd2494ee70		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3880 8048 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.