Malicious PDF — malware analysis report

Static analysis result for SHA-256 e46838f8057376a0…

MALICIOUS

PDF

38.2 KB Authoring application: Poppler-utils
MD5: 01de78661010550a01807515c73aadd1 SHA-1: 02158587ba6bb807de8d99c935519f313ad63d44 SHA-256: e46838f8057376a00e2acbfb35842c068c2f3ccaacfa26116c752837ce663c7e
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded URLs pointing to other PDF files across various domains. This behavior is indicative of a link farm or a distribution mechanism for further malicious content, as suggested by the 'PDF_SEO_LINK_FARM' heuristic and ClamAV detection. The ML classifier also strongly flagged this file as malicious. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cidal.net/uploads/1/3/0/5/130541384/80017abf.pdf
    • http://hostmaster.liverpoolfilmfestival.net/uploads/1/3/0/8/130874396/8823946.pdf
    • http://unitedwomenveterans.org/uploads/1/3/0/3/130313262/godikajolukejavupod.pdf
    • http://allinone75.com/uploads/1/3/0/6/130639810/7a366b20f.pdf
    • http://iwonderwouldi.com/uploads/1/3/0/3/130323822/ragenibaxuwaga-sixinetag-powekofo-mijekasija.pdf
    • http://blog.compassintelligence.com/uploads/1/3/0/4/130483520/wozarabira.pdf
    • http://andersonbikes.com/uploads/1/3/0/5/130589088/8bac3b427b.pdf
    • http://woodfordvalleyschool.com/uploads/1/3/0/7/130775075/bokelovamaw-jotikozerabekat-jogexipobij.pdf
    • http://bsiinvisto.com/uploads/1/3/0/6/130640018/vowevoredisenap.pdf
    • http://www.upandupbookkeeping.com/uploads/1/3/0/2/130289755/korelafuwibugaru.pdf
    • http://tita.si/uploads/1/3/0/4/130479312/saleminirezeb.pdf
    • http://andrewtimmer.com.au/uploads/1/3/0/6/130604145/nigenapi.pdf
    • http://www.mhcustomhomes.com/uploads/1/3/0/9/130969362/4040710.pdf
    • http://nbptwedding.com/uploads/1/3/0/8/130814328/5478021.pdf
    • http://factoftheland.com/uploads/1/3/0/6/130640013/10dad33b92083d.pdf
    • http://toddlerdisciplineapp.com/uploads/1/3/0/6/130639513/649221.pdf
    • http://rivendellberry.com/uploads/1/3/0/4/130476594/melajif.pdf
    • http://networkinginhighheels.com/uploads/1/3/0/4/130476135/benoxetiw.pdf
    • http://www.knotsam.com/uploads/1/3/0/8/130874009/5469212.pdf
    • http://maryplewisdesigns.com/uploads/1/3/0/7/130740517/rokeluma.pdf
    • http://bodhimassagedarwin.com/uploads/1/3/0/5/130544781/gomerugepolegibi.pdf
    • http://usedcarsfortrade.com/uploads/1/3/0/2/130289278/kotigav-xuzerokupigewe-jiboto-gevimegezeri.pdf
    • http://www.alexmateer.com/uploads/1/3/0/6/130604140/wopuwip_mipotepile.pdf
    • http://mowerok.com/uploads/1/3/0/2/130271031/5105304.pdf
    • http://www.meatloafprincess.com/uploads/1/3/0/2/130289694/130289694.html#letras+del+abecedario+en+cursiva

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000030fb.bin
45bf47943433ee89b27c09ec146f52fc6fdf962ba9e8dc83ebbf7f6826665e73		 pdf-font-stream PDF embedded font (sfnt) at offset 0x30FB 8600 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.