Malicious PDF — malware analysis report

Static analysis result for SHA-256 c3d0f0236244897c…

MALICIOUS

PDF

37.4 KB Authoring application: ImageMagick
MD5: 9b6a6376451ce7358b3da11a6ad1c21a SHA-1: fccbc53c7076e5c038f8e02f054c7997dbdf7448 SHA-256: c3d0f0236244897c160770e792234d5682506216dd42f14584857f8c0ba5b304
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of embedded external links, identified by the 'PDF_SEO_LINK_FARM' heuristic. The ClamAV detection and ML classifier also indicate maliciousness. The document body, though obfuscated, contains text related to coloring pages and also lists the same external URLs, suggesting a lure to click these links.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://familiesfeedinghope.com/uploads/1/3/0/5/130547486/4268354.pdf
    • http://drandrewwalker.com/uploads/1/3/0/2/130272477/9fa6bd3da50fe2.pdf
    • http://47496702.nhd.weebly.com/uploads/1/3/0/4/130436450/5a937c6e.pdf
    • http://accessmudjimbashores.com/uploads/1/3/0/4/130489803/jezexozal-seduvu-maferenosokeza.pdf
    • http://princetoncycling.com/uploads/1/3/0/3/130313427/5963252.pdf
    • http://colinaway.com/uploads/1/3/0/6/130639052/1336271.pdf
    • https://polasopakiminup.weebly.com/uploads/1/3/0/2/130291033/bc102ea4.pdf
    • http://zezowozivo.colorsun.ru/uploads/2020/01/28/752ee.pdf
    • http://gojiw.janderu.xyz/uploads/2020/01/28/6468453.pdf
    • http://holochainers.com/uploads/1/3/0/4/130484005/2499612.pdf
    • http://acwri.org/uploads/1/3/0/6/130639661/171325.pdf
    • http://drumlessonsatl.com/uploads/1/3/0/2/130287920/130287920.html#ni%C3%B1os+dibujando+para+colorear

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000012da.bin
e18a66cb496d08eb627f58d07cbf46bbd1b3faaf1668e8c96b890570d5094565		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12DA 9716 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.