Malicious PDF — malware analysis report

Static analysis result for SHA-256 139d28ddea27111d…

MALICIOUS

PDF

35.2 KB Authoring application: Adobe PDF Library 9.0
MD5: 3c0a3e4bf072a084c13452ea201e5270 SHA-1: a34244c8afc749f9295fbcb2e0b7140c031d73ac SHA-256: 139d28ddea27111dc3e43022a7c03b9beb72afb21e9e029557c264e5b0550fbb
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains a large number of embedded external links, a technique often used for SEO manipulation or to distribute malicious content. ClamAV detected this file as Pdf.Phishing.TtraffRobotInstall-7605656-0, and an ML classifier also flagged it as malicious. The document body itself appears to be malformed or truncated, but the primary malicious activity is the mass linking.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://mail.craigcliff.com/uploads/1/3/0/6/130603890/dubol.pdf
    • http://richardsnyderbrownu.com/uploads/1/3/0/4/130477245/sujuduvuxisikuf.pdf
    • http://rachaelcrossman.com/uploads/1/3/0/3/130323642/4183598.pdf
    • http://tysprettythings.com/uploads/1/3/0/5/130543743/lojikof_lidipexajama_vuperonuro.pdf
    • http://mail.yongintaekwondocollege.com/uploads/1/3/0/3/130379604/faxolosi-sopugu-kabinabenexo-rewutavul.pdf
    • http://mycorporatecounselor.com/uploads/1/3/0/7/130776032/vukoj.pdf
    • http://www.we4jesus.com/uploads/1/3/0/9/130968942/8448715.pdf
    • http://dragons-media.com/uploads/1/3/0/2/130270873/selulujalomerir_sodeveve.pdf
    • http://danielojones.com/uploads/1/3/0/7/130775002/ac459d41a90563d.pdf
    • http://tracynovakconsulting.com/uploads/1/3/0/6/130639267/ruxoxitod_retuperoriva_nafepalemizub_laruwawoxideru.pdf
    • http://nwm12.club/uploads/1/3/0/3/130379408/bevetufokelaf_mezazuvitu_diwixobijanofa_fudivexoluput.pdf
    • http://ettstore.co/uploads/1/3/0/6/130640010/sagugi.pdf
    • http://loveyourguts.live/uploads/1/3/0/4/130477085/xamunuxo-jezuziribev-dokiz-wetuv.pdf
    • http://jennamccabe.com/uploads/1/3/0/5/130550698/130550698.html#case+definition+of+typhoid+fever

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000030d2.bin
62099c589f914fab9111de7de18d040019e8ea7dcdd4b36324da0fa551540294		 pdf-font-stream PDF embedded font (sfnt) at offset 0x30D2 7704 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.