Malicious PDF — malware analysis report

Static analysis result for SHA-256 cae4b3a20571fc26…

MALICIOUS

PDF

31.8 KB Authoring application: SWFTools
MD5: d5a843ca8e91de696a6d136eca3cb6ac SHA-1: ac972a643ae7e5758a8cb906eb2111a5763d1cbb SHA-256: cae4b3a20571fc266859b60742f20f5029a32af9e2c6f2fa5f12f877ec145234
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file was flagged by multiple heuristics, including ClamAV and an ML classifier, as malicious. The PDF_SEO_LINK_FARM heuristic indicates a large number of external links, with the first being http://northwestlouisianaautomationgroup.com/uploads/1/3/0/5/130541662/duzibolegosu_saxiwudiwoz_nunalipabax_gasadi.pdf. This suggests the document's primary purpose is to distribute malicious links, likely for phishing or malware distribution, rather than providing legitimate content.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://northwestlouisianaautomationgroup.com/uploads/1/3/0/5/130541662/duzibolegosu_saxiwudiwoz_nunalipabax_gasadi.pdf
    • http://ultracooltrends.com/uploads/1/3/0/4/130488196/lulofiluguguj.pdf
    • http://allisongiessuebelhair.com/uploads/1/3/0/5/130588506/df6ebd925.pdf
    • http://miltonmurray.org/uploads/1/3/0/5/130550663/2605201.pdf
    • http://theharrishawkinshometeam.com/uploads/1/3/0/5/130588811/nakukusaded_sipojujewif.pdf
    • http://urfacefix.com/uploads/1/3/0/6/130603690/f8256db412.pdf
    • http://newsolutionsit.com/uploads/1/3/0/5/130540118/5710471.pdf
    • http://abeliangroup.ventures/uploads/1/3/0/5/130550752/derazedariwoke_nosebagita_gaderage_fulavesuse.pdf
    • https://wegugivukenuvoz.weebly.com/uploads/1/3/0/5/130542996/segul.pdf
    • http://millennialstitcher.com/uploads/1/3/0/6/130640218/7224631.pdf
    • http://vpokerfriends.com/uploads/1/3/0/5/130588864/dobob.pdf
    • http://spectaclesbroadway.com/uploads/1/3/0/6/130603896/sarexukepajig.pdf
    • https://rudogidaf.weebly.com/uploads/1/3/0/5/130538831/suwutezofafa_butilexesi_loviripa.pdf
    • http://djsacademy.com/uploads/1/3/0/4/130488833/130488833.html#gulf+breeze+dolaplar%C4%B1

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000013d9.bin
010bf839269cebd85ced233d02446ad646097d614f1d31b864bc8e62323f879d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13D9 9124 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.