Malicious PDF — malware analysis report

Static analysis result for SHA-256 12f9f2f17bd91c48…

MALICIOUS

PDF

49.9 KB Authoring application: SWFTools
MD5: fbd0d735a76ea508f62103875b025ccc SHA-1: 5e1928206aed67103fc3a2c8aa90e293d31c4a1a SHA-256: 12f9f2f17bd91c48c0341258530672ad2bf26937ea34d442511cff667990805a
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded URLs pointing to other PDF files, a technique often used for SEO manipulation or to distribute further malicious content. ClamAV detected this file as 'Pdf.Phishing.TtraffRobotInstall-7605656-0', indicating a phishing or traffic redirection intent. The ML classifier also strongly flagged this PDF as malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://imagesofcleveland.com/uploads/1/3/0/6/130604054/5445410.pdf
    • http://berryneonsignserviceseattle.com/uploads/1/3/0/6/130604254/muruwa.pdf
    • http://kirtiklis.com/uploads/1/3/0/6/130604177/dazafesawav-titinipuwavazog.pdf
    • http://44michigan.com/uploads/1/3/0/2/130288341/07d7b23.pdf
    • http://brain-restore.com/uploads/1/3/0/2/130272511/kijibarajize.pdf
    • http://azpoloassn.com/uploads/1/3/0/2/130272282/2879476.pdf
    • http://www.magmaeng.co.il/uploads/1/3/0/4/130435524/wopepupadusokese.pdf
    • http://ki-logistics.com/uploads/1/3/0/4/130489371/3623726.pdf
    • http://www.inspirebartlesville.com/uploads/1/3/0/6/130621114/kabakugidiwuzaz_nixaw_bakafovowonodo_xosuze.pdf
    • http://lyonchambers.com/uploads/1/3/0/4/130489371/jajewekawiwimi.pdf
    • http://www.lifeandlemonsboutique.com/uploads/1/3/0/4/130488270/3682516.pdf
    • http://nakitahogans.com/uploads/1/3/0/4/130483338/dapaz-jifutazemej.pdf
    • http://mikaimtrading.co.za/uploads/1/3/0/6/130604768/8555828.pdf
    • http://stresswiseatwork.com/uploads/1/3/0/4/130483393/4731762.pdf
    • http://kaimedvetdental.org/uploads/1/3/0/5/130547812/9e786.pdf
    • http://canisbodywork.com/uploads/1/3/0/3/130379740/5007964.pdf
    • http://www.allprodecksomaha.net/uploads/1/3/0/7/130776358/wunopawinu.pdf
    • http://mail.imatech.ch/uploads/1/3/0/4/130476703/gokokupo-pogirulimik.pdf
    • http://mrsscunningham.com/uploads/1/3/0/2/130289214/jafekafulid-xasulagefet-wevaz.pdf
    • http://mylittlecutfootcabin.com/uploads/1/3/0/7/130739027/a982127.pdf
    • http://comprarseguidoresdeinstagram.com/uploads/1/3/0/7/130738720/212880.pdf
    • http://syracusechildrenschorus.org/uploads/1/3/0/2/130274305/628418.pdf
    • http://www.millscountychamber.com/uploads/1/3/0/7/130775075/bewof_nogumiwofom_febijerer_maxutula.pdf
    • http://www.instinctlyoga.com.au/uploads/1/3/0/7/130739764/130739764.html#contoh+soal+aspek+keperilakuan+pada+audit+internal

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001389.bin
84ca5d3ecc108353ea2131b9ab0fd000baaae03e8e93c81e73d64e30084d002c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1389 7664 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.