Malicious PDF — malware analysis report

Static analysis result for SHA-256 fd23126f95e62768…

MALICIOUS

PDF

44.8 KB Authoring application: Serif PagePlus
MD5: b3d9a476e47d8e7d2bf78d4f40d908f2 SHA-1: 409ac74708e6c19a20343070d2f6f2e1973b7c82 SHA-256: fd23126f95e627685677d7321b39dd542e00ed23a8c589d83da8b7d8b6e4088a
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded URLs pointing to other PDF files across various domains. This behavior is indicative of a link farm or a distribution mechanism for further malicious content, as flagged by the PDF_SEO_LINK_FARM heuristic. The ML classifier and ClamAV detection strongly support the malicious nature of this file. The primary intent appears to be directing users to a network of external resources, likely for SEO poisoning or to serve as a landing page for phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://abbie-stout--family.rominastiebenphotography.com/uploads/1/3/0/5/130539428/xaxekokenobumef_negokojapore_vumulur_mefusokonepeze.pdf
    • http://www.zpguitar.com/uploads/1/3/0/6/130603753/durowewasigeturona.pdf
    • http://metroeastinterfaith.com/uploads/1/3/0/7/130739772/nurovojewevoxolejap.pdf
    • http://thomashsieh.com/uploads/1/3/0/4/130489025/nonibikoxamirof.pdf
    • http://alicetxchamber.org/uploads/1/3/0/5/130541763/1148786.pdf
    • http://spencertunickbooks.com/uploads/1/3/0/5/130541443/1129853.pdf
    • http://preapprovalcredit.com/uploads/1/3/0/6/130621890/5767463.pdf
    • http://tristanprettymanmusic.com/uploads/1/3/0/7/130739845/88a2a23a9b5bf.pdf
    • http://www.thebaudelaires.com/uploads/1/3/0/3/130313358/1223532.pdf
    • http://drbrettagrant.com/uploads/1/3/0/5/130551611/1545046.pdf
    • http://alwaysperfectsheet.com/uploads/1/3/0/8/130813111/9306193bc59575b.pdf
    • http://illinoisbadminton.com/uploads/1/3/0/2/130289262/26501.pdf
    • http://northcotswolds.com/uploads/1/3/0/3/130323526/seram-wovesolasamod-puworanigup.pdf
    • http://ccwtalk.com/uploads/1/3/0/5/130588700/padogimefijowix_vezim_serezunijuluguz_guzataviku.pdf
    • http://bggloballogistics.com/uploads/1/3/0/5/130551331/wajisafigudoj.pdf
    • http://geeksmind.com/uploads/1/3/0/2/130271011/rivuz-nabawipepegug.pdf
    • http://dream-maker-institute.com/uploads/1/3/0/7/130738504/f726e57127897.pdf
    • http://postacuteepisodes.com/uploads/1/3/0/6/130604333/verevimow_miwadepob_vagiwasulojoki.pdf
    • http://kyflowernseed.com/uploads/1/3/0/6/130639887/130639887.html#caterpillar+generator+set+sizing+guide

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004f00.bin
03c811db367ec4f4ee54704b7348390907b7b41948462fbff29ddbedbfee70f1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4F00 8792 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.