Malicious PDF — malware analysis report

Static analysis result for SHA-256 e322eccc2eca52ec…

MALICIOUS

PDF

42.6 KB Authoring application: PDFedit
MD5: e8a8d1225a823c934dfe08c97a7b9110 SHA-1: dad74a0e2007e397154572b35e317fa39b0bdf94 SHA-256: e322eccc2eca52ecd38b3ea01cf2c7897fb1effba4e6f00b5a09efea81b8fc9e
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links to external PDF files, a technique often used for SEO poisoning or to redirect users to malicious content. The ClamAV detection and ML classifier strongly indicate malicious intent, consistent with a phishing or malware distribution lure. No scripts were extracted, but the extensive link farm is the primary indicator of malicious activity.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://neonserwis.pl/uploads/1/3/0/5/130539048/vuketapi-fuvowupu.pdf
    • http://michelleveixmccartan.com/uploads/1/3/0/5/130590474/keremokewopiborimi.pdf
    • http://dogtalephoto.com/uploads/1/3/0/3/130379226/didoga-tipodafakawi.pdf
    • http://mtdromedaryuc.org/uploads/1/3/0/4/130476669/1735228.pdf
    • http://robinsonbasketball.com/uploads/1/3/0/2/130272963/6001787.pdf
    • http://mrmojo.com.br/uploads/1/3/0/6/130622106/lezuruselepexojapi.pdf
    • http://artisanmadegemstones.com/uploads/1/3/0/5/130590416/64c279.pdf
    • http://pitsoulis-lift.gr/uploads/1/3/0/4/130488850/jarolunaz.pdf
    • http://nataliekimballfitness.com/uploads/1/3/0/2/130289185/dedirexuzika.pdf
    • http://baddazzbikes.com/uploads/1/3/0/4/130435757/1891514.pdf
    • http://apocalypsepi.com/uploads/1/3/0/5/130588546/1865a81.pdf
    • http://modestohandyman.com/uploads/1/3/0/6/130639535/417560781a18.pdf
    • http://bejustalittlebetter.com/uploads/1/3/0/6/130639956/130639956.html#class+9+ncert+mathematics+solution+pdf

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000012eb.bin
bcf088297e82c18123d1c9a84e4829d6abef039d988501b226e8d2b132ffe056		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12EB 8316 bytes
font_01_sfnt_off000063da.bin
77695712eb9c7f1780777a481dcf13c5064ad153a546ff17b22d45ae6dca8a44		 pdf-font-stream PDF embedded font (sfnt) at offset 0x63DA 6576 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.