Malicious PDF — malware analysis report

Static analysis result for SHA-256 cd195f5689a0689e…

MALICIOUS

PDF

38.8 KB Authoring application: GIMP
MD5: 0fb17a7a881fcddee11dd7b9be395542 SHA-1: c88f71df63fbaecaaedf780d00e85e12e96b930b SHA-256: cd195f5689a0689e0b5069719e01b573dfb4b6e0ec463fba92c38d32ebafff90
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. This suggests a phishing or SEO spam campaign, aiming to direct users to potentially malicious content hosted on numerous domains. The ML classifier and ClamAV detection strongly support the malicious verdict.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://badladyflicks.com/uploads/1/3/0/4/130489241/lesuza.pdf
    • http://pascoseo.com/uploads/1/3/0/4/130476075/tanokejov_didibuzufonum_niwiwe_wexoku.pdf
    • http://politicskilleen.org/uploads/1/3/0/2/130289415/3178106.pdf
    • http://jillunikel.net/uploads/1/3/0/5/130589281/vejinos.pdf
    • http://transform-together.org/uploads/1/3/0/5/130588395/julizezuko-gufusujafakewo-wupixixuzuxo-pemudez.pdf
    • http://beingdance.com/uploads/1/3/0/2/130289530/163ccf.pdf
    • http://northernwoodlandindianart.com/uploads/1/3/0/6/130604554/63fc3a900a1e87c.pdf
    • http://www.fieldsmovie.com/uploads/1/3/0/2/130273845/3c78f01f16361.pdf
    • http://333-tools.com/uploads/1/3/0/7/130739994/98cb0b1.pdf
    • http://crumpgreenhouse.com/uploads/1/3/0/6/130605331/bukudabozuvax_pikitexobija_fifin_fojax.pdf
    • http://nineviewer.com/uploads/1/3/0/8/130813831/pilazigogevov.pdf
    • http://mathprnt.net/uploads/1/3/0/8/130813643/69b25788c19a4b.pdf
    • http://thedownsideofbliss.com/uploads/1/3/0/5/130540290/javiporedewebeke.pdf
    • http://camping-graesselmuehle.de/uploads/1/3/0/6/130604737/4500411.pdf
    • http://www.kingtracksuits.com/uploads/1/3/0/6/130639464/223334.pdf
    • http://aukstamford.com/uploads/1/3/0/5/130588775/puwinu.pdf
    • http://xlntcoffee.com/uploads/1/3/0/4/130475955/33b830de5296248.pdf
    • http://www.farcryvideo.com/uploads/1/3/0/2/130274319/pijojetu.pdf
    • http://bookbop.com/uploads/1/3/0/7/130739155/lulude.pdf
    • http://87solutions.net/uploads/1/3/0/8/130814057/6662482.pdf
    • http://sequoia-hc.com/uploads/1/3/0/5/130547078/4178136.pdf
    • http://geneveverobinson.com/uploads/1/3/0/6/130640027/9404180.pdf
    • http://alebalieiro.cl/uploads/1/3/0/2/130288559/4efd4.pdf
    • http://survive2life.com/uploads/1/3/0/7/130775557/1c527623de8c9f.pdf
    • http://mingrentang.bpmtc.com/uploads/1/3/0/5/130588377/130588377.html#augmented+reality+%28ar%29+and+virtual+reality+%28vr%29

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003516.bin
396a68fc96af0fc6caf72a7c261bb661194a98071891b258faf4677cd6a8a85f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3516 7712 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.