Malicious PDF — malware analysis report

Static analysis result for SHA-256 f5898b3b11d53efd…

MALICIOUS

PDF

35.1 KB Authoring application: Soda PDF
MD5: e731ba54fe53009e20bcd071e4f85727 SHA-1: b50cba7459c585c9ec03ef5d0b6138d31dfb093b SHA-256: f5898b3b11d53efd5b45aa6818ab7d54dc0e45c7495e5d8b6f2c395f115fdb72
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded links to external PDF documents, a technique often used for SEO manipulation or to distribute further malicious content. The ClamAV detection and ML classifier strongly indicate malicious intent. The heuristic 'PDF_SEO_LINK_FARM' specifically identifies the mass external PDF link farm, with the first URL being http://akodesigns.com/uploads/1/3/0/6/130621557/dufebubawi.pdf. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://akodesigns.com/uploads/1/3/0/6/130621557/dufebubawi.pdf
    • http://aldf.ca/uploads/1/3/0/4/130436261/bazojasu.pdf
    • http://www.motomomfuel.com/uploads/1/3/0/7/130775832/b869ef6.pdf
    • http://netballinthecommunity.co.uk/uploads/1/3/0/6/130604004/961bd3.pdf
    • http://viperfishmedia.org/uploads/1/3/0/5/130540219/tepusivuloxiges.pdf
    • http://webmail.thsathleticshof.com/uploads/1/3/0/6/130605219/8d11a216dc5f.pdf
    • http://www.pocketstopit.com/uploads/1/3/0/6/130639407/b36b9.pdf
    • http://bfes-sce-association.org/uploads/1/3/0/7/130776483/d2c0d64fad.pdf
    • http://www.thefashionfarmer.com/uploads/1/3/0/4/130483667/0ea6a7.pdf
    • http://hostmaster.thebigbowcompany.co.uk/uploads/1/3/0/7/130776603/ximubek-rajepivini.pdf
    • http://alabatabeauty.com/uploads/1/3/0/5/130542907/sabowez.pdf
    • http://tommystable.com/uploads/1/3/0/2/130288406/xikobo_muzawugukuvu_biwipel_vunezifapizowe.pdf
    • http://www.melaniesiegel.com/uploads/1/3/0/3/130324126/130324126.html#international+basketball+rules+pdf

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000033b9.bin
7b05087cf67eb0b55e8a73d7f7e9299081bc855e4543f3683c69e6036b81c227		 pdf-font-stream PDF embedded font (sfnt) at offset 0x33B9 7084 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.