Malicious PDF — malware analysis report

Static analysis result for SHA-256 e647cb2ccea4b336…

MALICIOUS

PDF

36.0 KB Authoring application: Solid Converter PDF
MD5: 029045425f581ba6bd5ed7838a10e576 SHA-1: 308e1e08f039427e80a89e3305b2ba951c0faa7b SHA-256: e647cb2ccea4b3363a83053a25b84b97afd25f7001a3dbbc473647d40a74d885
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1566.002 Spearphishing Link

The PDF contains a large number of embedded links to external PDF files hosted on various domains. This behavior is indicative of a link farm or a phishing campaign designed to redirect users to potentially malicious content. The ClamAV detection and ML classifier strongly support its malicious nature.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://nicolegoodrich.com/uploads/1/3/0/2/130288427/gejal-vijazitezun-xozepejego.pdf
    • http://thetrixxband.com/uploads/1/3/0/6/130639941/1951453.pdf
    • http://mochapterseven.com/uploads/1/3/0/4/130483924/ziwojutoleju.pdf
    • http://lucubratus.com/uploads/1/3/0/4/130488069/soliropemaxo-suduta-pejapatekeforug.pdf
    • http://villaeleganza.com/uploads/1/3/0/6/130620705/2850815.pdf
    • http://mta-sts.mx.tiedyeharvest.com/uploads/1/3/0/6/130622110/2374880.pdf
    • http://borntogarden.net/uploads/1/3/0/9/130969576/827791.pdf
    • http://actuary.education/uploads/1/3/0/5/130538937/5440702.pdf
    • http://www.pmifox.net/uploads/1/3/0/8/130874099/rerovesapabuzufin.pdf
    • http://lessons4life101.com/uploads/1/3/0/5/130539660/5702333.pdf
    • http://narrins.com/uploads/1/3/0/6/130603690/rufudu_mijunu_bosulezanezuxud_tobimosidaw.pdf
    • http://thekookas.com/uploads/1/3/0/7/130739232/4531573.pdf
    • http://kimleephotography.net/uploads/1/3/0/8/130814407/sexezefoboxo.pdf
    • http://mx.stephcolehair.com/uploads/1/3/0/5/130551166/ea248e118.pdf
    • http://platinumpoolsandpatios.com/uploads/1/3/0/4/130490117/mibenaguvazifi.pdf
    • http://mijaliscogrill2.com/uploads/1/3/0/3/130313088/ziroxo.pdf
    • http://www.frontierbuilders.org/uploads/1/3/0/7/130740442/751393.pdf
    • http://abullfrogstudio.com/uploads/1/3/0/2/130272636/5672347.pdf
    • http://westcoastbuilder.com/uploads/1/3/0/6/130621185/4e411076e5b2.pdf
    • http://bloomandbeyond.com/uploads/1/3/0/5/130547515/vasotit_kibaje.pdf
    • http://nongress.org/uploads/1/3/0/6/130639641/4788511.pdf
    • http://starrmark.net/uploads/1/3/0/8/130813063/130813063.html#edit+text+in+adobe+pro+dc
    • http://westcoastbuilder.com/uploads/1/3/0/6/130621185/4e4110

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002d80.bin
4e049418990e55826bd3eeddfbee7aaa17481e8b67133c42b2f150d17c1b4abf		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2D80 7516 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.