Malicious PDF — malware analysis report

Static analysis result for SHA-256 fbee9a8f597dd69d…

MALICIOUS

PDF

47.5 KB Authoring application: Serif PagePlus
MD5: be60ad148d329b809d4b9d7a4aa299b3 SHA-1: 38c92882fd20bb5a625a2c7ce15ed10ef92f7642 SHA-256: fbee9a8f597dd69d16a09108dbc13aef9c7ce6067cb1dac551c447bd5ecffe7e
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded URLs pointing to other PDF files hosted on various domains. This behavior is indicative of a link farm or a distribution mechanism for further malicious content, as flagged by the PDF_SEO_LINK_FARM heuristic and ClamAV detection. The ML classifier also strongly indicated maliciousness. No scripts were extracted from this sample, and the document body was heavily obfuscated and truncated, preventing a more detailed analysis of its specific lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.innerkeyhypnotherapy.com/uploads/1/3/0/3/130313783/xurifegolob_vusulonofe.pdf
    • http://283bemis.com/uploads/1/3/0/8/130874432/467c2db97f502.pdf
    • http://saudebras.com/uploads/1/3/0/5/130545021/bb4312cb52.pdf
    • http://motionautodetailing.net/uploads/1/3/0/5/130550911/1083719.pdf
    • http://disruptioneer.com/uploads/1/3/0/6/130604948/bovujo.pdf
    • http://morphsparchd.com/uploads/1/3/0/4/130488294/3bc3cc1432f4a.pdf
    • http://analethics.com/uploads/1/3/0/4/130435851/9257b7868b86.pdf
    • http://northeconstruction.com/uploads/1/3/0/7/130739640/9455027.pdf
    • http://bucksnortnrun.com/uploads/1/3/0/7/130739098/lamigigevuxejamomaf.pdf
    • http://msmarmenia.org/uploads/1/3/0/6/130621622/bonil.pdf
    • http://recordingstudiospokane.com/uploads/1/3/0/7/130775211/1174882.pdf
    • http://opcloud.net/uploads/1/3/0/8/130814581/5925a07242e85.pdf
    • http://myartonanything.com/uploads/1/3/0/2/130273617/vinivegamifud.pdf
    • http://erguvanmobilya.com/uploads/1/3/0/8/130814788/mifin-pubexupozosewi.pdf
    • http://www.crbcdobson.com/uploads/1/3/0/5/130550969/8686525.pdf
    • http://electrotech.vip/uploads/1/3/0/7/130776003/sudasevefafame.pdf
    • http://hostmaster.theagileworkshop.com/uploads/1/3/0/8/130814669/watirimudi.pdf
    • http://sachianimalrescue.com/uploads/1/3/0/8/130813953/9fd363ecc3d157.pdf
    • http://sandybailes.com/uploads/1/3/0/5/130551718/fujavirita.pdf
    • http://www.vabeachtrainer.com/uploads/1/3/0/4/130489038/47321c9464.pdf
    • http://rustysranchpoodles.com/uploads/1/3/0/5/130539763/vigilepavom-rimufudaxuga.pdf
    • http://360pro.be/uploads/1/3/0/7/130740055/kodijezifomilavuno.pdf
    • http://latinofoodcenter.org/uploads/1/3/0/6/130639865/130639865.html#automatic+door+opener+using+arduino+and+pir+sensor+pdf

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004a0e.bin
b095009e1aa7b679086a2dd093949a1e2bfdfa179c83d9e64a20210f199a406d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4A0E 1544 bytes
font_01_sfnt_off000054c5.bin
a97970f4ea393ffebfb0e51731d36e81a73711318f160421098899daa21bd473		 pdf-font-stream PDF embedded font (sfnt) at offset 0x54C5 9200 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.