Malicious PDF — malware analysis report

Static analysis result for SHA-256 f4b8d884014e3da6…

MALICIOUS

PDF

35.4 KB Authoring application: ImageMagick
MD5: 08e30d2cfe4868f1cd9b51ce87c9e2f3 SHA-1: 09eb322a45f50311e82d128283fe6e1bbf090145 SHA-256: f4b8d884014e3da6d8246ce1d77b1249051b9f8d3e243cb5422442aee2828718
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded external links, as indicated by the PDF_SEO_LINK_FARM heuristic. These links point to various domains, each hosting a PDF file with a numeric or book-like slug. This pattern is consistent with SEO poisoning or a link farm used to distribute malicious content or redirect users. The ML classifier and ClamAV detection further support the malicious nature of this file.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://noellenadeau.com/uploads/1/3/0/5/130588232/6424798.pdf
    • http://wikicoding.com/uploads/1/3/0/8/130813550/ab5d61aa6ba7d4f.pdf
    • http://dc2017.net/uploads/1/3/0/7/130775506/nukatitugom-vopiwit.pdf
    • http://suburbanhennepinhousingcoalition.com/uploads/1/3/0/2/130287872/31387026.pdf
    • http://authorbellabryce.com/uploads/1/3/0/6/130639145/bisapibeleg-zetetupijin.pdf
    • http://triplex-arrow.com/uploads/1/3/0/5/130543996/8650280.pdf
    • http://constructionjbc.com/uploads/1/3/0/5/130545818/d5d204a2a56.pdf
    • http://easycompmx.com/uploads/1/3/0/8/130874046/56602.pdf
    • http://www.sisterfriendlyproductions.com/uploads/1/3/0/5/130589348/afd4c4ce5.pdf
    • http://blockchainbetterbusiness.com/uploads/1/3/0/7/130739906/kitosalexakevogaj.pdf
    • http://ineavet.com/uploads/1/3/0/4/130477036/tenapeni.pdf
    • http://forknowspoonlater.net/uploads/1/3/0/3/130312926/1639721.pdf
    • http://bankufx.com/uploads/1/3/0/2/130273589/6405838.pdf
    • http://taxidrivers4cleanwater.org/uploads/1/3/0/6/130621470/mibabovaketufo-sefigevafoki-vevinofinokofer-bobakaguwugofi.pdf
    • http://lalantika.com/uploads/1/3/0/6/130620885/745201.pdf
    • http://www.madornot.com/uploads/1/3/0/2/130273573/759987.pdf
    • http://atlantaasta.voyagerwebsites.com/uploads/1/3/0/5/130546804/130546804.html#data+analysis+toolpak+mac+excel+2010
    • http://triplex-arr

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002dde.bin
bb1ceb6a45c567f3c219095b08afd7104b28602b24fbfaada7dcb519722a5d0d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2DDE 8060 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.