Malicious PDF — malware analysis report

Static analysis result for SHA-256 ebe2ff1f7cbee813…

MALICIOUS

PDF

35.1 KB Authoring application: GIMP
MD5: ec50b640671727c2ebe1e89b4929363a SHA-1: 27e5c123a0752261d7aa2448f035c39000df786a SHA-256: ebe2ff1f7cbee81318ebc9a2e0e782e9e4bb55ca7d8bee9d64965760655902d2
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded links to external websites, a technique commonly used for phishing or distributing further malware. The heuristic 'PDF_SEO_LINK_FARM' specifically identifies this behavior, pointing to a network of sites that likely host malicious content. The document body, while containing a lure about a zombie survival guide, also directly embeds several of these suspicious URLs, reinforcing the phishing or redirection intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://fourleafcloverhart.com/uploads/1/3/0/7/130740084/kafojokafota_fupimeledeb_dawab.pdf
    • http://moodieshop.com/uploads/1/3/0/2/130289649/zexuvuwozodanes_faxusibexif_latajujufefux.pdf
    • http://mytraining.today/uploads/1/3/0/6/130639827/cf10b247.pdf
    • http://movieseaon.com/uploads/1/3/0/6/130603907/6720228.pdf
    • http://bookgrand548.weebly.com/uploads/1/3/0/2/130291624/7086667.pdf
    • http://artofcannabiz.com/uploads/1/3/0/4/130488067/8036171.pdf
    • http://reboundat.com/uploads/1/3/0/7/130740429/130740429.html#max+brooks+zombie+survival+guide+pdf

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000010df.bin
f993a9b99ffa1adac46aa25ff411f5a3f4b5b4de0922349053a3633e5c9705ef		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10DF 7652 bytes
font_01_sfnt_off000041e2.bin
669a22844ddb84b64a1d93eb6147c2b8b7ca76f4316fe4be2bbf69c96252e72a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x41E2 16180 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.