Malicious PDF — malware analysis report

Static analysis result for SHA-256 d2505798c73a9cff…

MALICIOUS

PDF

41.2 KB Authoring application: PDFedit
MD5: ab99d3682fc8a956ff5561b4569c5637 SHA-1: 21bb126e943881e8db30d85343954d6d5bfe8fc3 SHA-256: d2505798c73a9cff5169f1e7ea195117e58cd854e3a440b0a785e9ca8909366e
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links to external PDF files hosted on various domains. This behavior is indicative of SEO poisoning or a phishing campaign designed to drive traffic to malicious content. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a phishing or traffic-driving intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.crystal-alexzandra.com/uploads/1/3/0/5/130588573/5300104.pdf
    • http://www.moonshot.games/uploads/1/3/0/9/130969759/1766830.pdf
    • http://eycongrats.com/uploads/1/3/0/5/130551765/45cdb3d72b.pdf
    • http://deliyannides.org/uploads/1/3/0/5/130539428/4502793.pdf
    • http://madcarn.com/uploads/1/3/0/4/130491001/fofipumagatare.pdf
    • http://amyrakowczyk.studiormusic.com/uploads/1/3/0/4/130483872/7350094.pdf
    • http://myentelechy.com/uploads/1/3/0/7/130776413/3472422.pdf
    • http://ddeusa.com/uploads/1/3/0/6/130639510/1605606.pdf
    • http://gnomebrew.net/uploads/1/3/0/5/130551198/762361.pdf
    • http://jaiku.net/uploads/1/3/0/3/130323666/sefiwuxodenov.pdf
    • http://mx.jaysdetailing.com/uploads/1/3/0/3/130379319/4306218.pdf
    • http://mail.sherrirodgers.com/uploads/1/3/0/5/130542859/c3bb20.pdf
    • http://79piccadilly.com/uploads/1/3/0/5/130552084/kukigolubika.pdf
    • http://tigerlilyphoto.com/uploads/1/3/0/7/130776120/xuledowiniwezanena.pdf
    • http://abcraftsman.com/uploads/1/3/0/7/130739781/mijebujosofizakesoz.pdf
    • http://technical-recruiter.net/uploads/1/3/0/3/130313333/tazatasuf.pdf
    • http://wangshangdubo.br3h.com/uploads/1/3/0/6/130621296/130621296.html#geometry+worksheet+special+right+triangles+30-60-90
    • http://amyrakowczyk.studiormusic.com/uploads/1/3/0/4/130483872/735

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002ca8.bin
65ca2fa633a49bc637c245e3469a24bec82cbb291b9200d770c42ee2df1588ac		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2CA8 16096 bytes
font_01_sfnt_off0000444e.bin
a230727a06149f0bf2fe8980fe0d57abf63109bd5411d380aee067b9379d2ea6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x444E 8200 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.