Malicious PDF — malware analysis report

Static analysis result for SHA-256 c772439e1a7e6c0d…

MALICIOUS

PDF

43.6 KB Authoring application: pstoedit
MD5: 11d737fb6c68f83bd966c214343de912 SHA-1: c3b8665753da3e727a648cd1b0201756cf76636f SHA-256: c772439e1a7e6c0d42a94e71124796244976bd82b630e9fccd876551fe5d455f
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

This PDF file was flagged by multiple heuristics as malicious, including a critical finding for a PDF SEO link farm. The file contains 31 external links, predominantly hosted on domains like pciprimer.com, directing users to other PDF files. The ML classifier also assigned a very high probability of maliciousness. The document body content is heavily corrupted and unreadable, preventing a more detailed analysis of its specific lure.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://pciprimer.com/uploads/1/3/0/6/130620752/zevuxidurisuxukuj.pdf
    • http://jackbrucker.net/uploads/1/3/0/7/130738975/ropuz-logefo-teziwemizuwij.pdf
    • http://customlovecandles.com/uploads/1/3/0/6/130620919/zuriwiseroku.pdf
    • http://zenobunny.com/uploads/1/3/0/5/130550881/xaxolitewoza_fipamo.pdf
    • http://mta-sts.mail.laneforward.com/uploads/1/3/0/7/130738964/luniwox-perokiwikelibux-suminemosagimow-xojime.pdf
    • http://openbookkeeping.org/uploads/1/3/0/6/130604030/zuzuruwok.pdf
    • http://oddher.com/uploads/1/3/0/6/130605306/1387997.pdf
    • http://www.rutgerscybersecurity.com/uploads/1/3/0/4/130476342/235b3eb.pdf
    • http://roanokewomensmarch.org/uploads/1/3/0/5/130551266/namulemamizinowo.pdf
    • http://interrogait.com/uploads/1/3/0/8/130873893/cc35c7df.pdf
    • http://mikewrong.com/uploads/1/3/0/5/130550955/3725b3eb8ae.pdf
    • http://www.struth.com/uploads/1/3/0/5/130542875/34ae06d977.pdf
    • http://www.pthformat.pl/uploads/1/3/0/7/130738780/2723744.pdf
    • http://lpunfinishedbusiness.org/uploads/1/3/0/6/130604904/vokenarolupugu.pdf
    • http://getgreatdjs.com/uploads/1/3/0/4/130483279/2101658.pdf
    • http://mail.actiontire.com/uploads/1/3/0/8/130874674/5c2582a7.pdf
    • http://digitalproductsdatabase.com/uploads/1/3/0/7/130775135/lubozejiw.pdf
    • http://weathergy.com/uploads/1/3/0/7/130776642/sukew.pdf
    • http://formidablecorp.us/uploads/1/3/0/5/130551073/sugonusefawuliju.pdf
    • http://benkregel.com/uploads/1/3/0/3/130379206/130379206.html#weight+loss+diet+plan+for+vegetarians+indian
    • http://mta-sts.mail.laneforward.com/uploads/1/3/0/7/130738964/luniwox-perokiwikelibux-suminemos

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004a6d.bin
ad84bd135d8f032497ff09b1bbe0aa4c1fea26c6b5f6cc3346a4e6676556f1ba		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4A6D 8824 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.