Malicious PDF — malware analysis report

Static analysis result for SHA-256 e2f99c4664383f01…

MALICIOUS

PDF

36.4 KB Authoring application: Serif PagePlus
MD5: 343366db92f336b82bae737d2090af49 SHA-1: 57fe4bc2bf4b5ee6d9d72ca246970fafb13b057e SHA-256: e2f99c4664383f01f322fad0a247b7036db0adb9d138726ca4ccb4e24aa64824
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded URLs pointing to other PDF files hosted on various domains. This behavior is characteristic of SEO spam or phishing campaigns that use link farms to distribute malicious content. The ClamAV detection and ML classifier further support the malicious nature of this file.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://neatlysheltered.com/uploads/1/3/0/3/130313286/jomosim-bubije.pdf
    • http://norwoodhighschool.net/uploads/1/3/0/6/130620585/07d17.pdf
    • http://collabra-nation.com/uploads/1/3/0/6/130639362/gubevolafel-wetosulopi-nemakedofe.pdf
    • http://msilaser.com/uploads/1/3/0/6/130605244/gukumipi-sewipatulo-mevugakug-posemozer.pdf
    • http://jayseigel.com/uploads/1/3/0/6/130604580/bivavavajogem.pdf
    • http://oosternieland.net/uploads/1/3/0/7/130775251/vadanonopipi.pdf
    • http://dataunify.com/uploads/1/3/0/4/130476574/nivivojukoziw.pdf
    • http://tealmoonstudios.com/uploads/1/3/0/5/130551302/3701dc1905ea8c.pdf
    • http://cosmicbrushes.com/uploads/1/3/0/2/130287882/solozojalav-gawonesaf-balapulikanuno.pdf
    • http://yogasoutherner.com/uploads/1/3/0/4/130476458/ce3aba.pdf
    • http://resucet.store/uploads/1/3/0/6/130603789/mozorenerukiza.pdf
    • http://newenglandopportunityproject.org/uploads/1/3/0/5/130590157/fixejorisabef.pdf
    • http://www.carpstyle.com/uploads/1/3/0/6/130639239/pizinowadutonivupib.pdf
    • http://notanuffibizans.com/uploads/1/3/0/4/130476322/ramujabifusunixigupe.pdf
    • http://micheletroy.com/uploads/1/3/0/7/130776877/1487496.pdf
    • http://silverteekitchen.com/uploads/1/3/0/8/130814575/gowok.pdf
    • http://marlboroughmustangs.org/uploads/1/3/0/4/130489467/1770983.pdf
    • http://8uaw3.bpmtc.com/uploads/1/3/0/3/130379115/130379115.html#hungry+jacks+vouchers+sept+2019

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002f0a.bin
352d498563e72bf4b2f69ca364b24c84a127d69489a4d05be8c7de3d6489ce5f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2F0A 8728 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.