Malicious PDF — malware analysis report

Static analysis result for SHA-256 d3d2a6fcbbebe38f…

MALICIOUS

PDF

39.4 KB Authoring application: Mobipocket Creator
MD5: a69be5afc089c5ef6d5e9a67d59cb358 SHA-1: c3faec886f12ab6e12986e007a65b84ff11e2131 SHA-256: d3d2a6fcbbebe38f2ed130af075b7363f2701fa373fbd557c6a206914d17cbc4
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF contains a large number of external links, many of which point to other PDF files hosted on similar domains. This behavior is indicative of a link farm or a phishing lure designed to redirect users to malicious content. The ClamAV detection and ML classifier strongly suggest malicious intent, likely related to phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://wangyaofabric.com/uploads/1/3/0/6/130621344/wazev_nejekokeb.pdf
    • http://susiestreats.com/uploads/1/3/0/7/130775505/fagulibep.pdf
    • http://mysebgroup.com/uploads/1/3/0/2/130271098/c738415c44f812b.pdf
    • http://aimnetwork.co/uploads/1/3/0/3/130312971/5339780.pdf
    • http://russlazaruk.com/uploads/1/3/0/5/130546880/52941.pdf
    • http://honeyandserifs.com/uploads/1/3/0/2/130271206/jelobezokofibo.pdf
    • http://midlandsallstar.com/uploads/1/3/0/6/130604002/4397716.pdf
    • http://thehustlernetwork.com/uploads/1/3/0/6/130604482/kuvuvoduxoz.pdf
    • http://skatefiction.com/uploads/1/3/0/2/130287463/e915ce8f4.pdf
    • http://www.riverinbetween.com/uploads/1/3/0/6/130640159/a12489e25d9e4.pdf
    • http://liquorlawsvt.com/uploads/1/3/0/4/130476687/9849305.pdf
    • http://mytgob.com/uploads/1/3/0/5/130539516/tazudi.pdf
    • http://mnsbearings.com/uploads/1/3/0/7/130776578/e1d540343f8817.pdf
    • http://rentalpropertycheck.com/uploads/1/3/0/5/130589158/galovematog.pdf
    • http://youarenotaloneproject.com/uploads/1/3/0/3/130379341/1434220.pdf
    • http://bullfrogs-butterflies.com/uploads/1/3/0/3/130323207/galuxinijexer-daluzulexozir-mapapepujo-vubiseg.pdf
    • http://petsingoodhealth.com/uploads/1/3/0/2/130287472/gevadon-dexawiziva-fugijoso.pdf
    • http://lisa-and-dustin.rominastiebenphotography.com/uploads/1/3/0/7/130740212/130740212.html#vlookup+and+hlookup+example

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003b5c.bin
2ac6988aa246bf9162ce26c5a3e3b7ac7e739046200561eaddb50351661a0a75		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3B5C 8660 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.