Malicious PDF — malware analysis report

Static analysis result for SHA-256 f16a703dad0abebc…

MALICIOUS

PDF

39.2 KB Authoring application: Nitro PDF
MD5: bc18d79919a9ec243cf517b253572c5d SHA-1: 414d247ea18a00f3a50aed8d9d46bc99b73ba31f SHA-256: f16a703dad0abebcc248b3aa7bdd1acf2d9c9c3e5bc39a0d4a298a3b23250a19
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links to external PDF files, a technique often used for SEO spam or to redirect users to malicious content. The heuristic 'PDF_SEO_LINK_FARM' and the ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' strongly indicate a malicious intent. The document body contains garbled text and a reference to 'Gallstone pancreatitis diet', which appears to be a lure.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://doublekdorpersheepranch.com/uploads/1/3/0/3/130313120/7d6a3e8.pdf
    • http://tjtlzy.com/uploads/1/3/0/6/130639069/3cca40c0a4f29.pdf
    • http://www.whites-butchers.com/uploads/1/3/0/7/130738497/sujutemovokikiduvij.pdf
    • http://admin.leithtrust.org/uploads/1/3/0/7/130739048/vefotomizageze.pdf
    • http://itemhustle.com/uploads/1/3/0/4/130489567/08022678b.pdf
    • http://www.italiaeliberta.it/uploads/1/3/0/4/130478009/jaderoxusoxerowife.pdf
    • http://alexanicolebooks.com/uploads/1/3/0/7/130739200/7504690.pdf
    • http://www.studentleaderssummit.com/uploads/1/3/0/2/130272462/5032645.pdf
    • http://journeysinsixth.com/uploads/1/3/0/5/130544078/8724617.pdf
    • http://misbailes.com/uploads/1/3/0/6/130620687/8fc3511b30.pdf
    • http://www.ohbloop.nl/uploads/1/3/0/8/130873740/vekedizetudag_lixejifuzaga.pdf
    • http://imagecenterspa.com/uploads/1/3/0/6/130605506/d89acb.pdf
    • http://mytimemassaggi.com/uploads/1/3/0/3/130313091/2455239.pdf
    • http://mta-sts.mail.musicmansion.org/uploads/1/3/0/7/130740183/simaliwa.pdf
    • http://oandpideas.com/uploads/1/3/0/6/130604227/7187865.pdf
    • http://oursustainableag.com/uploads/1/3/0/4/130476423/e3667f596970.pdf
    • http://gravenoisepress.com/uploads/1/3/0/6/130621800/puxeg.pdf
    • http://balirestandrelax.com/uploads/1/3/0/8/130814526/tuzatuluwe.pdf
    • http://mx.chimemn.com/uploads/1/3/0/8/130813586/wulaxa-tesemuvanas-mekiputom-kewomirifu.pdf
    • http://mail.cynthiahovdaphotography.com/uploads/1/3/0/2/130289554/2b6db225d2b.pdf
    • http://recstats.net/uploads/1/3/0/2/130291575/db162299b3.pdf
    • http://www.esmsearch.com/uploads/1/3/0/7/130738696/130738696.html#gallstone+pancreatitis+diet
    • http://oursustainableag.com/uplo

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003962.bin
40e80f14ea3640e909ece784a941002dc3b4efeb6add59b8fee15dcebf12aa11		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3962 7820 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.