Malicious PDF — malware analysis report

Static analysis result for SHA-256 d3b0982e1dec2959…

MALICIOUS

PDF

80.5 KB Authoring application: Serif PagePlus
MD5: b4b07c7d1eb8509ad5386681d073864d SHA-1: cbd2aa9361c945a4daa283bc211d11f6a755fe38 SHA-256: d3b0982e1dec2959befaf5f473e1e5c3707cf642d9351227d9675af6f8cb86c8
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF contains a large number of external links to other PDF files, a technique commonly used for SEO poisoning and phishing lures. The ClamAV detection and ML classifier strongly indicate malicious intent. The embedded URLs are likely part of a campaign to redirect users to malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://borough18mc.com/uploads/1/3/0/2/130274017/ccd3aa309f5.pdf
    • http://opossumpouchwildlife.com/uploads/1/3/0/5/130589000/wuseb-mibema.pdf
    • http://koiriensijaiskoti.com/uploads/1/3/0/7/130776016/97eaf.pdf
    • http://kb-mtr.com/uploads/1/3/0/5/130588621/jibagomopuwiborar.pdf
    • http://dz-explosive.net/uploads/1/3/0/4/130476505/jikatexazuduravij.pdf
    • http://sacredawakeningandhealing.com/uploads/1/3/0/3/130379113/lidipexo_rumuda_kulafexiputile.pdf
    • http://www.thegouldfamily.org/uploads/1/3/0/3/130313221/fijesus-garexuvobotoxe-judagog.pdf
    • http://allancapital.ca/uploads/1/3/0/4/130436190/rusozatodunato_tezumugotiwidar_golesibezi.pdf
    • http://festivallatinosacramento.com/uploads/1/3/0/5/130544090/sudewujuva.pdf
    • http://daytonheritagemuseum.org/uploads/1/3/0/7/130739629/vanilunalejibewi.pdf
    • http://strongfamily.info/uploads/1/3/0/5/130540477/xaminopedodun.pdf
    • http://ecuadoroscuro.com/uploads/1/3/0/7/130740264/rofujitojusefozu.pdf
    • http://mysss.ca/uploads/1/3/0/4/130483909/kewewujuzozadow-pukafalupexudal.pdf
    • http://hypergrid.xyz/uploads/1/3/0/4/130436139/lariponuxobusuduve.pdf
    • http://trvlrad.com/uploads/1/3/0/7/130775371/8831211.pdf
    • http://nashobavalleyextractco.com/uploads/1/3/0/7/130740141/wironutojaxadorepi.pdf
    • http://www.alanamarieartworks.ca/uploads/1/3/0/7/130775808/xukiwa.pdf
    • http://badengyulechengdailizhuce.f18.ebkf.org/uploads/1/3/0/7/130738625/a64e3e48c.pdf
    • http://shoebrewnation.com/uploads/1/3/0/6/130639875/8439840dd55d.pdf
    • http://lucashauptmann.com/uploads/1/3/0/4/130488539/gediwu_litifofejoza_xiwazivowedebab_sedumosusodog.pdf
    • http://restorationfellowshipchurchwv.com/uploads/1/3/0/6/130620640/minupofate-nagezikumaja-gijevesem.pdf
    • http://mainstreetnewjersey.net/uploads/1/3/0/6/130639336/dd5543febd.pdf
    • http://clubatlantis.co/uploads/1/3/0/4/130476048/dubalilerodilej.pdf
    • http://pawtasticpetsitters.com/uploads/1/3/0/6/130603968/7276069.pdf
    • http://sta-66-99-58-197.ladse.org/uploads/1/3/0/6/130621675/130621675.html#abraham+maslow+biographical+information
    • http://mainstreetnewjersey.net/uploads/1/3/0/6/130639336/dd554

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002d25.bin
d6953824df5c0cab3d4f97f5ff62ed10bda4d2de7c35790999d97264ecb0fea6
pdf-font-stream PDF embedded font (sfnt) at offset 0x2D25 8984 bytes
font_01_sfnt_off0000f5be.bin
9c70772738280065930db61d29b0eee79557f8152c8dc8c27cbb99d0b6b3e0b3
pdf-font-stream PDF embedded font (sfnt) at offset 0xF5BE 16200 bytes