Malicious PDF — malware analysis report

Static analysis result for SHA-256 ce37a7d435e62399…

MALICIOUS

PDF

51.3 KB Authoring application: Pdftk
MD5: 272932960e56515512badb24b12d82ee SHA-1: 70a2dd69a4a2678e9ea6ebe87982edb85830a3c7 SHA-256: ce37a7d435e62399f15ad7d9ef9fe9331817739a31c594bbab111ec30fe2f5c7
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded external links, as indicated by the PDF_SEO_LINK_FARM heuristic. The ML classifier and ClamAV also flagged this file as malicious, specifically as a phishing or traffic-robot-related threat. The embedded URLs likely lead to further malicious content or phishing pages, aiming to redirect users to a large number of external PDF files.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://nakedroots1.com/uploads/1/3/0/2/130291640/nomojigefatub.pdf
    • http://snapshotsofwisdom.com/uploads/1/3/0/6/130621641/gukasizebipenaron.pdf
    • http://countingwithelliot.com/uploads/1/3/0/5/130551957/kerekadi.pdf
    • http://thepilgrimageofhope.org/uploads/1/3/0/5/130543640/dcab4f785.pdf
    • http://remarkablecanine.com/uploads/1/3/0/5/130541743/samun.pdf
    • http://milanchurch.com/uploads/1/3/0/3/130379216/7597865.pdf
    • http://marieequi.com/uploads/1/3/0/5/130589150/fekirotoropevon.pdf
    • http://adentamalaysia.com/uploads/1/3/0/6/130639889/jogebagizojevez.pdf
    • http://moagabrielsson.com/uploads/1/3/0/5/130589094/8289098.pdf
    • http://3csstudios.com/uploads/1/3/0/4/130478261/1bb1c959.pdf
    • https://birorajose.weebly.com/uploads/1/3/0/2/130274305/0dc3a28.pdf
    • http://branduconsulting.com/uploads/1/3/0/5/130539437/34e48203.pdf
    • http://celebritydiethealth.com/uploads/1/3/0/5/130543538/baloraliwid.pdf
    • http://rdnu2u.com/uploads/1/3/0/5/130590244/4355315.pdf
    • http://partyplus613.ca/uploads/1/3/0/5/130588834/monoseluta.pdf
    • http://lafabriquededessins.com/uploads/1/3/0/4/130488338/6945175.pdf
    • http://gabrielajones.se/uploads/1/3/0/6/130621800/sowemigoragogo_fupuzixavowiviv.pdf
    • http://gustavogonzalez.mx/uploads/1/3/0/4/130491356/8867908.pdf
    • http://cambiatucasa.com/uploads/1/3/0/5/130550974/1beee7.pdf
    • http://apacint.com.au/uploads/1/3/0/4/130483238/pawiburizabewo.pdf
    • http://fefapuw.pansionat-chaika.com/uploads/2020/01/28/c651bce76.pdf
    • http://zavibigi.pdazip.ru/uploads/2020/01/28/3977073.pdf
    • http://7soundenergy.com/uploads/1/3/0/5/130542907/5875e55b7.pdf
    • http://northwestuu.com/uploads/1/3/0/6/130639076/130639076.html#matriz+metalica+biconvexa

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000011d2.bin
1c54dfe78f25792a2473da708ce548845ffab376113807ff833dfe594e66e0fe		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11D2 10528 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.