Malicious PDF — malware analysis report

Static analysis result for SHA-256 ec7290751418617c…

MALICIOUS

PDF

59.0 KB Authoring application: Soda PDF
MD5: 997bdfc8bcedfcf2bfe98068d6e03d48 SHA-1: 1ef58f4aefafeecd71d257d48384b95ace03bef4 SHA-256: ec7290751418617c25a12955f8e51a628c82efff4ffd7b587a26b4c57b28750f
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file was flagged by multiple heuristics, including a critical alert for a link farm containing numerous external PDF links. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further indicates a phishing or traffic redirection intent. The embedded URLs are likely part of a campaign to lure users to malicious sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://sinaidetroitmedicalfoundation.com/uploads/1/3/0/6/130640019/mibosakexutata.pdf
    • http://absolutely-coraldee.com/uploads/1/3/0/8/130814980/mupododemurani.pdf
    • http://libertyhallwriters.us/uploads/1/3/0/8/130874156/6893341.pdf
    • http://www.claritybartleet.com/uploads/1/3/0/5/130542822/3243120.pdf
    • http://rightwrite.net/uploads/1/3/0/2/130273740/d8b590.pdf
    • http://missveltriskindergarten.com/uploads/1/3/0/3/130379361/2e7f841db36.pdf
    • http://divinedwelling.org/uploads/1/3/0/6/130621264/sosegepebinuj_ravev_mafovabawotom.pdf
    • http://britanynavarretephotography.com/uploads/1/3/0/4/130436094/zotanaberebetu-japov.pdf
    • http://mssugarscloset.com/uploads/1/3/0/4/130435682/vimapakawunedo.pdf
    • http://hillsmixtape.co.uk/uploads/1/3/0/7/130739261/3fe5d8a25.pdf
    • http://jaynetoner.com/uploads/1/3/0/8/130873941/5496203.pdf
    • http://ulbsllc.com/uploads/1/3/0/2/130272853/sodesuximusip_luretonubexa.pdf
    • http://newbraunfelsmasonry.com/uploads/1/3/0/6/130640071/e1080a015a3c.pdf
    • http://www.hudu.life/uploads/1/3/0/5/130588499/9840ac8f65a54.pdf
    • http://professionallawncareandlandscapingservicesnm.online/uploads/1/3/0/5/130588333/2043457.pdf
    • http://adsl-63-204-18-13.benefitplans.org/uploads/1/3/0/2/130272496/130272496.html#alpha+1+and+beta+1+adrenergic+blockers

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000012af.bin
4c7afe07c8fef25741010cfd820d607a33f272b10527bc224bae65220a574e76		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12AF 9236 bytes
font_01_sfnt_off0000a699.bin
4d9ec2aec8f1ca6bebe1b56492fd55a77bba3a6e98efb76508c1b835d4eb9912		 pdf-font-stream PDF embedded font (sfnt) at offset 0xA699 2860 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.