Malicious PDF — malware analysis report

Static analysis result for SHA-256 f6bab8b4b81270b3…

MALICIOUS

PDF

88.0 KB Authoring application: Inkscape
MD5: cc99fad2d6391948f3e71d686f7f39bf SHA-1: 853043e2c09e36054169bdf3cf49cd25e2aa47e4 SHA-256: f6bab8b4b81270b3e8e20e88a4dd86ac02e64cc650a6af75740c34c1f7539dc2
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious File

The PDF contains a large number of external links, a technique often used for SEO manipulation or to distribute further malicious content. The ClamAV detection and ML classifier strongly indicate malicious intent. The embedded URLs point to a network of PDF files, suggesting a coordinated distribution effort.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Dropper.Agent-7839645-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Dropper.Agent-7839645-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cadatel.net/uploads/1/3/0/6/130639377/jerakuvoxewisoj_nuxaxukikurita_zofak.pdf
    • http://freerunbasics.com/uploads/1/3/0/8/130814907/rejikezesusozux.pdf
    • http://moanalipopo.com/uploads/1/3/0/7/130775328/f6e804a3d.pdf
    • http://mantasmiseviciusdesign.com/uploads/1/3/0/3/130313429/bukufevizanevuk.pdf
    • http://midcitycarriages.org/uploads/1/3/0/4/130476976/webofizel.pdf
    • http://holagatito.com/uploads/1/3/0/2/130273623/8083838.pdf
    • http://beardwash.com/uploads/1/3/0/2/130288439/37fd4b826a62e1b.pdf
    • http://mthopeucc.net/uploads/1/3/0/8/130814208/9680714.pdf
    • http://biking4life.org/uploads/1/3/0/6/130604226/3058109.pdf
    • http://conscience-skinlabs.com/uploads/1/3/0/5/130551907/3390801.pdf
    • http://cpanel.evylareau.com/uploads/1/3/0/2/130289809/130289809.html#bhagwat+geeta+in+sanskrit+and+hindi+pdf

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000b215.bin
91cf9cd4efac8f69dcdf587659185da8236567bce3e9e4f6a5ecd944f50fae4f		 pdf-font-stream PDF embedded font (sfnt) at offset 0xB215 1428 bytes
font_01_sfnt_off0000b91f.bin
ca889182d22413b1a5b6446cd5d954c095bfc2c8b2fec1022b19199100617195		 pdf-font-stream PDF embedded font (sfnt) at offset 0xB91F 16028 bytes
font_02_sfnt_off0000cf4a.bin
2b75ac3072a86ebd19f762dd666124e1708abb84c4aeb111ccafdad4dc9abe9d		 pdf-font-stream PDF embedded font (sfnt) at offset 0xCF4A 5960 bytes
font_03_sfnt_off0000e8d8.bin
522fb737a1e5cb1bf3e30d4cb78d40163f1f1ea20f31f71a53f7a908ea9fd336		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE8D8 21820 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.