Malicious PDF — malware analysis report

Static analysis result for SHA-256 d722604e9db345f1…

MALICIOUS

PDF

36.6 KB Authoring application: PDFBox
MD5: d2a75622fcd6d617a1eddf0df90c46a8 SHA-1: afbb75833a1e2e3300c9f08962b72cfb2148adf6 SHA-256: d722604e9db345f133894e9951039c78d8114fecb4b47d408777c2adee6c69f2
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF contains a large number of embedded links to external PDF files, a technique often used for SEO poisoning or to distribute malicious content. The ClamAV detection and ML classifier strongly indicate malicious intent. The embedded URLs are the primary IOCs, suggesting a campaign focused on redirecting users to potentially harmful content.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://hekatonkheries.email/uploads/1/3/0/4/130489467/29f086.pdf
    • http://adopttheborder.org/uploads/1/3/0/6/130605238/jugikomosaz.pdf
    • http://relationshipsartcollection.com/uploads/1/3/0/2/130289222/vepojasiroxeg.pdf
    • http://abdullah-francis.com/uploads/1/3/0/5/130551656/jefewosefewi-witezaziposudo-tudigonesoj-gewokitito.pdf
    • http://immigrationatx.com/uploads/1/3/0/4/130435902/9894739.pdf
    • http://autodiscover.webcard.online/uploads/1/3/0/2/130291475/gigekanamukimojodox.pdf
    • http://www.webanddesign.co.za/uploads/1/3/0/8/130813369/wabaradar_relobi_fumipegivimap_rodogeri.pdf
    • http://travel.stephaniejtravels.com/uploads/1/3/0/9/130969179/duvav.pdf
    • http://www.vemeto.com/uploads/1/3/0/7/130776786/webofedenapigel.pdf
    • http://christmaswishesbook.com/uploads/1/3/0/3/130313148/2114253.pdf
    • http://fiam.fiam.info/uploads/1/3/0/3/130379098/rapalu-kiwavugadini.pdf
    • http://movetoamendpdx.org/uploads/1/3/0/6/130640214/1630987.pdf
    • http://misspeggysdogwalking.com/uploads/1/3/0/6/130620952/1185582.pdf
    • http://narragansettgunclub.org/uploads/1/3/0/2/130273740/kusafukikanasoxavepe.pdf
    • http://awakewego.com/uploads/1/3/0/8/130873986/noluzijekadobut-sikade.pdf
    • http://peakathleticsystems.com/uploads/1/3/0/7/130775297/130775297.html#apspdcl+ae+notification+2014+pdf

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003399.bin
b311b6fdfd6acb2eb027fbdbcb274af54227be8737a374aaf971b1443c386adf		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3399 8096 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.