Malicious PDF — malware analysis report

Static analysis result for SHA-256 ccf74cb0abc07a69…

MALICIOUS

PDF

38.5 KB Authoring application: Inkscape
MD5: e1459725bda2e43a7e06557bf0f40ab3 SHA-1: 4b511902e9cce9a1eff4f045e5048cdb8075fa53 SHA-256: ccf74cb0abc07a69bfa30055cd2d099fd5f617fbf5083e7352c5850c795f2e9d
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of external links, many of which point to other PDFs hosted on similar domains. This behavior is indicative of a link farm designed to distribute malicious content, as suggested by the ClamAV detection and ML classifier. The primary malicious URL identified is http://movingmedicineali.com/uploads/1/3/0/7/130775837/lanujinubeb_sogoxumuzeses_sototus.pdf.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://github.com/adafr
    • http://movingmedicineali.com/uploads/1/3/0/7/130775837/lanujinubeb_sogoxumuzeses_sototus.pdf
    • http://openldap-builds.com/uploads/1/3/0/6/130604225/9624520.pdf
    • http://mielikkishots.com/uploads/1/3/0/6/130604321/d5b1a.pdf
    • http://thequiltedsoul.org/uploads/1/3/0/6/130620482/fidap-ginim.pdf
    • http://ccpropertyinvestment.com/uploads/1/3/0/7/130739116/4525737111ed72.pdf
    • http://newyorkcitycriminalattorney.net/uploads/1/3/0/3/130379237/574d9d45.pdf
    • http://mta-sts.mail.cloverealty.com/uploads/1/3/0/8/130813658/5097524.pdf
    • http://fidospantry.org/uploads/1/3/0/3/130323268/53fe1e32c74659.pdf
    • http://wooshspeed.com/uploads/1/3/0/4/130475984/wiwazubof.pdf
    • http://thaddeusnhizfamily.com/uploads/1/3/0/2/130270951/dufepido_wadonuziliris_rerosabeke_newofezir.pdf
    • http://craigheadcounty4hrabbitclub.com/uploads/1/3/0/4/130483546/e44c1a.pdf
    • http://adentamalaysia.com/uploads/1/3/0/2/130289371/xapomenizipeg-livawewigivow-sojenafo.pdf
    • http://www.brisbrattyboutique.com/uploads/1/3/0/7/130740489/rajoxavefewafewim.pdf
    • http://finehealthindia.com/uploads/1/3/0/4/130488509/c5bf36.pdf
    • http://americanpawoutlet.com/uploads/1/3/0/6/130620484/4874668.pdf
    • http://arthvrian.net/uploads/1/3/0/5/130546538/7927748.pdf
    • http://ns1.shownosocks.com/uploads/1/3/0/6/130621193/zogizolumidotajiruxi.pdf
    • http://www.wanderyonderdesigns.com/uploads/1/3/0/5/130589102/gozutepexilix-dupepidixa-sifetez.pdf
    • http://nomadicartist.org/uploads/1/3/0/2/130289662/6353560.pdf
    • http://spokaneboudoirphotography.com/uploads/1/3/0/5/130551282/boxelijedivoji_newaxavun_mabalelapo.pdf
    • http://relatedtoeverything.com/uploads/1/3/0/6/130621643/119807.pdf
    • http://xstreamspecial.xsideas.com/uploads/1/3/1/0/131070306/131070306.html#adxl345+python+library
    • http://americanpawoutlet.com/uploads/1/3/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000343e.bin
e25fa588230c3c5e405201fc2a09239c4c126bbfd84bc55a8642aa60cd9ca8c6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x343E 8428 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.