Malicious PDF — malware analysis report

Static analysis result for SHA-256 0c8e7f73ba1a86a8…

MALICIOUS

PDF

30.6 KB Authoring application: Mobipocket Creator
MD5: 1d4178b52fdb57ad4f655e5921b8a30b SHA-1: f5d78b33fa8fc17af742b3357ca2c7e16e1655cf SHA-256: 0c8e7f73ba1a86a8029877fb20fde4e651503effdada1be06521788b1dd98526
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded URLs, identified by the PDF_SEO_LINK_FARM heuristic, suggesting a link farm or redirection tactic. ClamAV detection as Pdf.Phishing.TtraffRobotInstall-7605656-0 further supports a phishing or malicious redirection intent. The document body, though heavily obfuscated, contains references to URLs that are likely part of this link farm.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.jennaraeacu.com/uploads/1/3/0/6/130604742/gitevalokupakuside.pdf
    • http://myhempisbomb.com/uploads/1/3/0/6/130621973/4708855.pdf
    • http://thejamesralexander.com/uploads/1/3/0/5/130540477/a9379d.pdf
    • http://bctee.com/uploads/1/3/0/6/130639267/9824124.pdf
    • http://sandiegosuperlawyers.com/uploads/1/3/0/5/130590724/xemupeminalulitir.pdf
    • http://cmcflourguam.com/uploads/1/3/0/6/130620684/2959197.pdf
    • http://fordflexlasvegas.com/uploads/1/3/0/6/130639549/bexirizewal.pdf
    • http://magiavioleta.com/uploads/1/3/0/6/130621309/ba8ce175.pdf
    • http://vegetarianspacecadet.com/uploads/1/3/0/5/130588670/vejerep.pdf
    • http://phase2concerts.com/uploads/1/3/0/5/130551651/3075096.pdf
    • http://stjohnlutheranruma.com/uploads/1/3/0/7/130775980/5063876.pdf
    • http://nobros.net/uploads/1/3/0/7/130776499/5d5cd893.pdf
    • http://roglicguitarlessons.com/uploads/1/3/0/7/130740141/ebcf6737fc.pdf
    • http://antoniobuehler.com/uploads/1/3/0/2/130289244/vazem_monul_jedadujas.pdf
    • http://jinnyjoestudios.com/uploads/1/3/0/6/130604616/5492786.pdf
    • http://birthingintentionally.com/uploads/1/3/0/8/130873978/soxobagojijevom.pdf
    • http://intermodelguatemala.com/uploads/1/3/0/5/130588961/59555.pdf
    • http://totallydreams.com/uploads/1/3/0/5/130539726/130539726.html#apache+junction+school+district

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001b6a.bin
a3efe47695ca5799a6a9e202d5044e845b0f42c18216f555da16ef8af326d0df		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1B6A 7552 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.