Malicious PDF — malware analysis report

Static analysis result for SHA-256 ed1c374f8a14d86d…

MALICIOUS

PDF

45.7 KB Authoring application: Nitro PDF
MD5: 2f019ab3090a5f4aecbbc682b597166b SHA-1: 477671aeb4c9fe9848f58aedb99df64c5952f722 SHA-256: ed1c374f8a14d86d2c05339128e7912c2dd4d4891ac0fd87519983d56326ff55
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. These links point to various domains, suggesting a campaign to distribute content or manipulate search engine results. The ML classifier and ClamAV detection strongly indicate malicious intent, likely related to phishing or malware distribution. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://michaelbthewriter.com/uploads/1/3/0/6/130621628/sipevazaxakob.pdf
    • http://vanopij.alika.icu/uploads/2020/01/28/pabiluduxezop.pdf
    • http://netherhaughfarm.com/uploads/1/3/0/3/130379362/fakado-gorok.pdf
    • http://mofouad.com/uploads/1/3/0/5/130589050/2206295.pdf
    • http://savhandyman.com/uploads/1/3/0/4/130436137/duzamezakanimisulat.pdf
    • http://bamboohealthsocks.com/uploads/1/3/0/6/130621353/roxasojiwu_lagiruzesaxu_roxotaxamig_xipusi.pdf
    • http://661junkhauling.com/uploads/1/3/0/5/130589374/11fbcb5.pdf
    • http://mycupidclothing.com/uploads/1/3/0/6/130621109/2357763.pdf
    • http://rehphotography.org/uploads/1/3/0/6/130621272/130621272.html#cascadilla+hall+cornell

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000011c0.bin
0a6a600af984fa6b6df92a6fc89e3484689ae3760d38ca8a0e906524052edf31		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11C0 8476 bytes
font_01_sfnt_off00006c9a.bin
499b893561b07790ed9b759d87fffa79aebe62e37b51571da3a5e0993ef98557		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6C9A 16084 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.