Malicious PDF — malware analysis report

Static analysis result for SHA-256 c5dad95e5a421cc6…

MALICIOUS

PDF

43.4 KB Authoring application: Mobipocket Creator
MD5: 3347a04428a8a83d988cecdb7fff773a SHA-1: 2f3c8f3d13376b827cc8509901ab8f501f9573f8 SHA-256: c5dad95e5a421cc62f6460d1e8625f7715a5711ea603ebec130020f4760c88a1
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. The ClamAV detection and ML classifier also indicate maliciousness. The primary function appears to be directing users to a network of other PDF files hosted on various domains, likely for SEO manipulation or to serve as a distribution point for further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://christinecaseyphotography.com/uploads/1/3/0/5/130550846/59ff82e63ddc.pdf
    • http://bewateryogaandcoaching.com/uploads/1/3/0/6/130620317/2678177.pdf
    • http://mold-a-rama.net/uploads/1/3/0/5/130589135/selotowikosidifas.pdf
    • http://chrismfwise.com/uploads/1/3/0/6/130640197/xigogokovixurap-zaxodu-sesosugekik.pdf
    • https://nuvesefasupev.weebly.com/uploads/1/3/0/4/130488891/wetipukunivadevumuwo.pdf
    • http://thrivewithjessiewhite.com.au/uploads/1/3/0/3/130313066/3247876.pdf
    • http://nasty-man.com/uploads/1/3/0/4/130476144/wulejekof_supufikanet_fufexasagivumu.pdf
    • http://nanmade-bags.com/uploads/1/3/0/6/130620234/b657e4144475.pdf
    • http://334northmission.com/uploads/1/3/0/5/130551599/dde29d7d259d.pdf
    • https://jibopelaruga.weebly.com/uploads/1/3/0/4/130436071/8702801.pdf
    • http://northernrailleaders.com/uploads/1/3/0/2/130288359/130288359.html#shake+my+sillies+out

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000012bc.bin
4ae1266f735344d305ef50bd8f5db7d277bcb19aa819e296065b02cb8ad18f07		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12BC 8340 bytes
font_01_sfnt_off00005f6b.bin
a36a67cfa9fbda8e9148b5cbfd1f1145743e9cec1474ca2a450a0615af39ce78		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5F6B 17604 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.