Malicious PDF — malware analysis report

Static analysis result for SHA-256 e225fabdeebe7c45…

MALICIOUS

PDF

38.2 KB Authoring application: PDFBox
MD5: b20b8ee8f336e5b6c14627406e2a11ad SHA-1: 405976a3242746e899cef6a086891e50b5e2239b SHA-256: e225fabdeebe7c4568798138bf84a21e34964a1d4df36e51350957bbe2e5193f
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF was identified as malicious by ClamAV and an ML classifier, and it contains a large number of external links pointing to other PDF files. This behavior is consistent with a link farm used to distribute phishing content or malware. The embedded URLs are likely part of this distribution mechanism.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://solutiontofamilytherapy.com/uploads/1/3/0/8/130814559/pisesuponikoxov-fifuwepeku-bamir.pdf
    • http://www.jamesvieira.com/uploads/1/3/0/5/130543059/vuboramuluzobefivad.pdf
    • http://nexuspos.net/uploads/1/3/0/3/130379504/savaxo-tapuwunutorupa.pdf
    • http://www.stenepme.net/uploads/1/3/0/3/130379244/dajibuzipinalavaja.pdf
    • http://azurdeplacements.fr/uploads/1/3/0/6/130621555/2029107.pdf
    • http://3dstereopad.com/uploads/1/3/0/5/130590622/9675434.pdf
    • http://mycryosculpt.com/uploads/1/3/0/5/130540937/luleturup-tetovuzovugex.pdf
    • http://portpainting.com/uploads/1/3/0/7/130775245/bemofudolat.pdf
    • http://himeslawoffice.com/uploads/1/3/0/5/130538990/dcd7263.pdf
    • http://airfilledlife.com/uploads/1/3/0/3/130379625/pemimu.pdf
    • http://atinamedicaltourism.com/uploads/1/3/0/8/130813645/7270079.pdf
    • http://loveit-defaultspanish.devsite-1.com/uploads/1/3/0/2/130289585/130289585.html#love+and+marriage+books+pdf
    • http://himeslawoffice.com/uploads/1

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003ca9.bin
adaac10c7a0814be84bce3776710db3ebd80c979972768015a7e48c544d0d74c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3CA9 8576 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.