Malicious PDF — malware analysis report

Static analysis result for SHA-256 e59147122c6a8570…

MALICIOUS

PDF

37.1 KB Authoring application: Nitro PDF
MD5: c077374830b4dcc342dd305b7a70e8ef SHA-1: 8d9dad3dcb8fb8077cd9ab2a3e93c80d91d7c18f SHA-256: e59147122c6a8570a5213064626923095b2ac6b1fba4fa4339b1684edb424c74
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded links to external PDF files hosted across various domains. This behavior is indicative of a link farm or redirection scheme, commonly used to distribute malware or conduct phishing attacks. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a malicious intent. No scripts were extracted from this sample, but the extensive URL distribution is the primary indicator of malicious activity.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ecobeautyeditor.net/uploads/1/3/0/8/130874082/5b484ffbb0a.pdf
    • http://thesplinteredmind.com/uploads/1/3/0/6/130621947/443714cc16.pdf
    • http://kittermancas.com/uploads/1/3/0/2/130287875/zugefawo_tapepedo_zudidanorifo.pdf
    • http://byblair.co/uploads/1/3/0/5/130588574/0dff1d262cbe0.pdf
    • http://allbaconstuff.com/uploads/1/3/0/5/130542875/lewigu.pdf
    • http://apiarydesigns.com/uploads/1/3/0/6/130620731/buwunevumed-zekoso-wabake-jibozezo.pdf
    • http://dmc-usmf.com/uploads/1/3/0/6/130639272/8551371.pdf
    • http://evan.co/uploads/1/3/0/2/130271153/ropedusebigoj_ruvalisi_zubakejiz.pdf
    • http://masturnation.net/uploads/1/3/0/5/130551004/dojuxemu-xevefovofixuxi.pdf
    • http://katsheahealingarts.net/uploads/1/3/0/7/130739284/debetezivovo.pdf
    • http://olympic-custom-construction.com/uploads/1/3/0/5/130551349/fozenuresorem.pdf
    • http://implicitknowledge.com/uploads/1/3/0/6/130603785/lezerazovidogasiw.pdf
    • http://nikkileon.de/uploads/1/3/0/7/130775780/3805190.pdf
    • http://missfoggscience.com/uploads/1/3/0/6/130639861/negupulow.pdf
    • http://lashesbyalyssaabq.com/uploads/1/3/0/7/130739192/rewez_dubiwozosinevi_favugasilub.pdf
    • http://lwfreferral.com/uploads/1/3/0/5/130542909/9ee8616df0.pdf
    • http://bentonoglesby.com/uploads/1/3/0/6/130621055/sedebedus-sipowaz.pdf
    • http://www.cyprusgliding.com/uploads/1/3/0/6/130639404/90691.pdf
    • http://improveed.org/uploads/1/3/0/3/130313513/jubew.pdf
    • http://alohawiki.net/uploads/1/3/0/2/130287536/5054524.pdf
    • http://adsl-64-169-66-165.millerpac.com/uploads/1/3/0/7/130740573/130740573.html#how+to+make+an+editable+pdf+in+adobe+acrobat+dc

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000031e0.bin
7763d8fd50cd96d86b29b7c282ddb4ce0f39103e4150ff18a21c3bc5c6a97711		 pdf-font-stream PDF embedded font (sfnt) at offset 0x31E0 7704 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.