Malicious PDF — malware analysis report

Static analysis result for SHA-256 d90df628e19960d8…

MALICIOUS

PDF

39.8 KB Authoring application: Solid Converter PDF
MD5: 9f2cb530b8eacbec5cea08ce8526dc8e SHA-1: 57204ba04b930990a4e30025a40cb7e402bdb1cc SHA-256: d90df628e19960d821805f316c2c3dcaf2dc1edff3686d7f24045f154f3d3ded
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded URLs pointing to other PDF files hosted on various domains. This behavior is indicative of a link farm or a distribution mechanism for further malicious content. The ClamAV detection and ML classifier strongly suggest malicious intent, aligning with the heuristic firing for PDF_SEO_LINK_FARM.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://davidquy.com/uploads/1/3/0/6/130621219/5029543.pdf
    • http://beestandards.org/uploads/1/3/0/2/130270894/bikexevaweluxezi.pdf
    • http://shootingrobots.com/uploads/1/3/0/5/130545484/dakakokapiropen-kugidudat-simeme-jijobixemowasez.pdf
    • http://oildale.news/uploads/1/3/0/4/130483123/1562301.pdf
    • http://scottsvalleyorthodontist.com/uploads/1/3/0/3/130313582/bamusejirevewugami.pdf
    • http://foreversay.com/uploads/1/3/0/5/130539227/silixunedaf.pdf
    • http://jewelrywithin.com/uploads/1/3/0/7/130775725/wivukerojilubitus.pdf
    • http://essenceofjoshuatree.com/uploads/1/3/0/2/130272488/weduj.pdf
    • http://erinferree.com/uploads/1/3/0/6/130604732/jepegawirasatov_porosut_fofize_tutop.pdf
    • http://thinkhappyvibehappy.com/uploads/1/3/0/8/130813314/bafisasonudoja_jidalo.pdf
    • http://staceylytle.com/uploads/1/3/0/2/130274301/kogen-pidab-nazuvoviguji.pdf
    • http://uvcheer.com/uploads/1/3/0/5/130589198/7bce656b6e8.pdf
    • http://agedanddistilled.com/uploads/1/3/0/5/130589083/mojogenenabimisabiti.pdf
    • http://newwavecarpetandtile.com/uploads/1/3/0/8/130873818/4298f6c37f54.pdf
    • http://mindfulnesslab.centre4innovation.org/uploads/1/3/0/4/130435684/555386.pdf
    • http://mandrilradio.com/uploads/1/3/0/5/130543685/rofomev_supemusazakas_kufatetul.pdf
    • http://www.homeautomationlittlerock.com/uploads/1/3/0/7/130740012/kaxaxuxawojiwil.pdf
    • http://pvstateofmind.net/uploads/1/3/0/7/130775403/29896a.pdf
    • http://vlogtv.net/uploads/1/3/0/7/130776776/dufebibeworusu.pdf
    • http://a1836163xstreamtravel.xsideas.com/uploads/1/3/0/7/130739528/130739528.html#pdf+to+text+converter+in+python
    • http://davidquy.com/uploads/1/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002e89.bin
50224c6c483bfa86a10f62efd7baa2c756f8036c0a911ebd537387e21b2fb6f3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2E89 2732 bytes
font_01_sfnt_off00003aed.bin
45d8a16a028a41a60c0cec6c0e7b3d85aedad5c8d4b9b8ef00e251378ce7f3ed		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3AED 8484 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.