Malicious PDF — malware analysis report

Static analysis result for SHA-256 01795d0febc2ab60…

MALICIOUS

PDF

40.3 KB Authoring application: GIMP
MD5: e30abfd0acfafbf7383a44f9f5d835b5 SHA-1: 7f012c654e49e78f79e0281ce5e72e1b5899f5cf SHA-256: 01795d0febc2ab60da7908529fbc2b3e8fdfef60aef4ad3e1cb260c953825fd8
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious File

The PDF file contains a large number of embedded links pointing to other PDF documents, a technique often used for SEO poisoning or to distribute malicious content. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the ML classifier strongly indicate malicious intent. The document body, while containing irrelevant text, also embeds several of these suspicious URLs.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://museumembassy.com/uploads/1/3/0/7/130776006/0d0e12780c90.pdf
    • http://amcarizona.com/uploads/1/3/0/3/130379638/9d716.pdf
    • http://nomoremondays.us/uploads/1/3/0/6/130640214/nilixolawufun_jesebopewu_wejajegotazivas_milokonoxakuv.pdf
    • http://mycph.info/uploads/1/3/0/5/130588506/kepexekadatofew.pdf
    • http://a1412531xstreamtravel.xsideas.com/uploads/1/3/0/5/130590462/130590462.html#ek+villain+banjaara+3gp+video+song
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://fedoraproject.org/wiki/Licensing/LiberationFontLicense
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000109a.bin
daa62f4f5ffb28864bb204ea4708e80e5dc633e52cc5656b013de5165f06a031		 pdf-font-stream PDF embedded font (sfnt) at offset 0x109A 8332 bytes
font_01_sfnt_off00004da2.bin
e91619dfd4c72a85464d95ef1ba4e67df13020651c42071bafbe521a61d9f7fc		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4DA2 2652 bytes
font_02_sfnt_off0000567c.bin
3682cce75eddeb81a22f14259646e723aa32b21c10e34e35249eac29d422c459		 pdf-font-stream PDF embedded font (sfnt) at offset 0x567C 16136 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.