Malicious PDF — malware analysis report

Static analysis result for SHA-256 f0de54e8c169862c…

MALICIOUS

PDF

42.1 KB Authoring application: pstoedit
MD5: e34ec14ec789a1b573c4b4d81c61e04b SHA-1: 54c078928dfe11cda9788b08862858817dd0fc54 SHA-256: f0de54e8c169862c428614a2ef22788aeae79db87af94ecee4635160f870c974
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded links to external websites, identified as a link farm. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the ML classifier output strongly indicate malicious intent, likely related to phishing or traffic redirection. The heuristic 'PDF_SEO_LINK_FARM' confirms the presence of numerous external links, with 'britemoonmarketing.com' being a dominant host. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://britemoonmarketing.com/uploads/1/3/0/6/130604519/87adb60.pdf
    • http://minibodegasdeconcepcion.com/uploads/1/3/0/5/130550824/6721794.pdf
    • http://73forms.com/uploads/1/3/0/5/130590208/2972548.pdf
    • http://bmcomput.com/uploads/1/3/0/7/130776603/jugisaralavo_zubuzusud.pdf
    • http://gnaftis.com/uploads/1/3/0/6/130603945/3574233.pdf
    • http://sfbaycomiccon.com/uploads/1/3/0/7/130776252/5063821.pdf
    • http://adeptwebsolutions.com.au/uploads/1/3/0/5/130590030/bizabajavegafomuneb.pdf
    • http://mutiny-cannabis.com/uploads/1/3/0/5/130542937/medetegapima.pdf
    • http://mylabeau.com/uploads/1/3/0/6/130604527/febokatosa_repofadup.pdf
    • http://neuropolisblog.com/uploads/1/3/0/8/130874516/xapikave.pdf
    • http://idealcleaning.org/uploads/1/3/0/5/130550928/kiduwod.pdf
    • http://soundkitsupply.com/uploads/1/3/0/6/130604521/2940982.pdf
    • http://cannacab420.com/uploads/1/3/0/4/130489437/012aeecf0c12.pdf
    • http://mikesrollingthndr.com/uploads/1/3/0/2/130274028/wuduwala-rivilesuvifuzu.pdf
    • http://myulrika.com/uploads/1/3/0/6/130603724/ribidoliri_tagulesoponubun_mimomogagukaw_gelirifuv.pdf
    • http://namiwashcounty.org/uploads/1/3/0/5/130539155/gigin.pdf
    • http://bullfrogimaging.com/uploads/1/3/0/7/130776619/ketakugum-fezenojuwewuj-vadakurezejuzir-vereniziv.pdf
    • http://nolancunningham.net/uploads/1/3/0/2/130287945/fixoditolokewiv_golekuzub.pdf
    • http://nwm4.club/uploads/1/3/0/6/130639903/rukilotuw.pdf
    • http://baomahuiyulechengguanfang.br3h.com/uploads/1/3/0/6/130639256/130639256.html#ethylene+acrylic+acid+copolymer+dispersion
    • http://myulrika.com/uploads/1/3/0/6/13060

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002da4.bin
2b57b2f7c8f3bc38d05bd7e1919dcd7d971d606ce90b2da6579e55cc4e86234a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2DA4 16260 bytes
font_01_sfnt_off000045ff.bin
267e528d5b9fe9d3b8be84f7a4ac7af67d9f7dd829e153dd96afcf6fb145191f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x45FF 8180 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.