Malicious PDF — malware analysis report

Static analysis result for SHA-256 fa733f464e918a62…

MALICIOUS

PDF

47.9 KB Authoring application: ImageMagick
MD5: d2e62251cf2cba4ed0e424a27e512f10 SHA-1: 8572e6c00eb198c5ac4875bf22406b43bf470f31 SHA-256: fa733f464e918a621c789557123b0201eba3367b87375709cb11aa3256444e71
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded URLs pointing to other PDF files hosted on various domains. This behavior is indicative of a link farm or a distribution mechanism for further malicious content. The ClamAV detection and ML classifier strongly suggest malicious intent, aligning with the PDF_SEO_LINK_FARM heuristic.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://metzgersu.com/uploads/1/3/0/5/130589427/4303901.pdf
    • http://www.magicwordeditingcompany.com/uploads/1/3/0/8/130814176/rirukutun.pdf
    • http://arielledollinger.com/uploads/1/3/0/8/130814297/xexoguxunetukunis.pdf
    • http://racks4retail.com/uploads/1/3/0/5/130538866/a7f59ad0d7c668f.pdf
    • http://nomudnolotuscs.org/uploads/1/3/0/3/130313191/zodul.pdf
    • http://mail.brucenyberg.com/uploads/1/3/0/7/130739260/efcdc2b162.pdf
    • http://atlshoebank.com/uploads/1/3/0/3/130379135/funuku.pdf
    • http://www.rtas.com/uploads/1/3/0/2/130288932/dc75fd6.pdf
    • http://jzwa.xyz/uploads/1/3/0/5/130540559/xebux-ramilaxag-famogun-vamujunebit.pdf
    • http://piropeandopueblo.com/uploads/1/3/0/7/130739119/1723382.pdf
    • http://kimbery-barrett.com/uploads/1/3/0/5/130551319/lexebunuwobi.pdf
    • http://tractortrailerrepairrichmond.com/uploads/1/3/0/6/130639183/kufopufunu-benurikoxebi-nusunipinov-jelisimidoko.pdf
    • http://southpawstraining.com/uploads/1/3/0/4/130435715/9790553.pdf
    • http://daretoteach.com/uploads/1/3/0/2/130272361/7e8544e1043.pdf
    • http://spokanefamilyheritagevideos.com/uploads/1/3/0/6/130621864/5757400.pdf
    • http://pyrosteria.com/uploads/1/3/0/7/130739269/7ef0ff57f4f6.pdf
    • http://flowpvp.com/uploads/1/3/0/7/130739392/5894029.pdf
    • http://support.futureappleceo.com/uploads/1/3/0/3/130323900/kugon_rubumitavalibod_jizev_wavifuw.pdf
    • http://07i9xx.salon225.com/uploads/1/3/0/3/130323377/130323377.html#admixtures+used+in+preparation+of+self+compacting+concrete

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005be4.bin
f4759ec9fe2361ce75bccaa30344a70c4ac771deec95dc2ccb372959b54e1382		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5BE4 8704 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.