Malicious PDF — malware analysis report

Static analysis result for SHA-256 11aac93a6331c2b3…

MALICIOUS

PDF

34.3 KB Authoring application: Serif PagePlus
MD5: 24730e6fc22d6c19a2ba4edb71ce945c SHA-1: 8098b7991591b8b9eb6ede1800f4d5c5a812afff SHA-256: 11aac93a6331c2b35ff4fc0f521c0c07b8190a654f622d356dfbdd18b8cde17c
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded URLs pointing to other PDF files hosted on various domains. This behavior is indicative of a link farm, often used for SEO manipulation or to distribute malicious payloads. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports the malicious nature of this document.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.jillbuckfield.com/uploads/1/3/0/7/130739063/dfa5f2d085a4d.pdf
    • http://leaguedesmoines.com/uploads/1/3/0/5/130541221/gevudibaxopaf-xigolex-fonawadukomemax-karibowinawire.pdf
    • http://teacheronclimatestrike.net/uploads/1/3/0/5/130551623/7535511.pdf
    • http://oxbottomcrest.com/uploads/1/3/0/6/130620857/7570382.pdf
    • http://mail.susanbdeane.com/uploads/1/3/0/7/130738915/fomigofura.pdf
    • http://affinityprofits.com/uploads/1/3/0/3/130313410/8f4ad.pdf
    • http://leannephilip.com/uploads/1/3/0/2/130288316/jesebibotezokepob.pdf
    • http://tzipporagugenheim.com/uploads/1/3/0/7/130776533/2599563.pdf
    • http://quartzvanitydirect.com/uploads/1/3/0/5/130588187/panusad_gakut_mikememasa.pdf
    • http://boilermakerjobs.net/uploads/1/3/0/4/130489742/nofikel.pdf
    • http://waggawaggaprobus.waggamatters.com/uploads/1/3/0/2/130270863/zivupubiwipafitope.pdf
    • http://www.release-counseling.com/uploads/1/3/0/5/130588999/130588999.html#activity+diagram+online+shopping

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000030b4.bin
6dee1947340384caeae9a215dfd6745333a662e45a01dcc4b69f7383b26b7535		 pdf-font-stream PDF embedded font (sfnt) at offset 0x30B4 7264 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.