Malicious PDF — malware analysis report

Static analysis result for SHA-256 cc02d55fdbf24019…

MALICIOUS

PDF

37.2 KB Authoring application: Adobe PDF Library 9.0
MD5: 0b3e11e24792a27b523a9a2cfaf6707f SHA-1: 5c9542421985899f4dc34411e856bc49d8ddbfd5 SHA-256: cc02d55fdbf240193ea9edfeb7a159d414c6f83fd9446e69d411ad2cca84d3f5
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links to external websites, a technique often used for SEO poisoning or phishing. The heuristic 'PDF_SEO_LINK_FARM' specifically identified this behavior, pointing to a network of sites, with 'mindfulprofits.co' being the first in the list. The ML classifier and ClamAV detection further support the malicious nature of this document, flagging it as a phishing or traffic redirection mechanism. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://mindfulprofits.co/uploads/1/3/0/6/130639593/porejixowipisojosaka.pdf
    • http://beniciaclocktower.com/uploads/1/3/0/6/130620950/5eeb423.pdf
    • http://jrequ.com/uploads/1/3/0/8/130874231/5973899.pdf
    • http://trainwithbritt.com/uploads/1/3/0/3/130379803/tenuji.pdf
    • http://www.groovetw.com/uploads/1/3/0/5/130551488/966c23f988d.pdf
    • http://awesomeroofcleaning.net/uploads/1/3/0/2/130271206/85c656081f5.pdf
    • http://onlytopsaler.site/uploads/1/3/0/7/130738681/nofujokivek.pdf
    • http://nxtgenacademy.com/uploads/1/3/0/2/130289359/1201715.pdf
    • http://bioemedialab.org/uploads/1/3/0/5/130590416/nibobebemexupox.pdf
    • http://www.excerciseiskey.com/uploads/1/3/0/4/130490461/dibogawej-pirinog-gunanukoza.pdf
    • http://divyaodontologia.com/uploads/1/3/0/5/130550912/fodipejim_fonali_sazemazixeru_gewikujuboda.pdf
    • http://amidlifesentence.us/uploads/1/3/0/5/130550775/gisibewelizabofetumi.pdf
    • http://spiritualpsychic.net/uploads/1/3/0/6/130639363/135ab531a.pdf
    • http://onlcf.org/uploads/1/3/0/4/130491850/4762914.pdf
    • http://limoncellodesigns.com/uploads/1/3/0/4/130483062/ruduwodakixekozaf.pdf
    • http://chgdressing.com/uploads/1/3/0/5/130590545/vawulawid.pdf
    • http://realitycure.com/uploads/1/3/0/6/130621608/jomijoj-tomira-nobunifazenike-resek.pdf
    • http://providencecard.com/uploads/1/3/0/7/130776262/bitojudufofugeg.pdf
    • http://shopbelfast.info/uploads/1/3/0/4/130494636/130494636.html#oracle+database+beginners+guide+pdf

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000033b8.bin
92cfc5c90ae7c869b0b4b6668eaef7eb89f10a670f1ce9aa04c1d2671ce5d786		 pdf-font-stream PDF embedded font (sfnt) at offset 0x33B8 7956 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.