Malicious PDF — malware analysis report

Static analysis result for SHA-256 1401b513cd802739…

MALICIOUS

PDF

39.1 KB Authoring application: Pdftk
MD5: 83e077c0ea421bd1810524da58728122 SHA-1: a710dd064ea2cd2a6adb44336324b47aed60f7a5 SHA-256: 1401b513cd802739d155b2e650835739f9fe5744418686395abcce2684c4b0f9
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF file was flagged by multiple heuristics, including a critical ClamAV detection for 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and a PDF_SEO_LINK_FARM rule. The file contains a large number of embedded URLs pointing to other PDF files across various domains. The ML classifier also strongly indicated maliciousness. The primary attack pattern appears to be the distribution of a link farm, potentially for SEO manipulation or to serve as a landing page for further malicious content delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://theexplicator.com/uploads/1/3/0/8/130874046/rezexup.pdf
    • http://nancymaldonado.com/uploads/1/3/0/4/130476496/8971547.pdf
    • http://theyoupower.com/uploads/1/3/0/7/130775680/3511701.pdf
    • http://seamistcollies.com/uploads/1/3/0/5/130588846/fuluxatezufikatomade.pdf
    • http://huguniversity.net/uploads/1/3/0/8/130813904/5185574.pdf
    • http://codebeforedawn.net/uploads/1/3/0/7/130775958/wujizuzunirexam.pdf
    • http://mana-hsi.com/uploads/1/3/0/2/130272319/powuveromupetojafo.pdf
    • http://adisera.com/uploads/1/3/0/6/130605516/xasagadebun.pdf
    • http://poolermassage.com/uploads/1/3/0/4/130475921/vewad.pdf
    • http://mombodfitness.com/uploads/1/3/0/7/130775429/6cce251ccf51.pdf
    • http://daduhuixianjinbaijiale.br3h.com/uploads/1/3/0/9/130969558/ridefasa.pdf
    • http://www.boswelljewelers.com/uploads/1/3/0/9/130969177/regukag-busakudofi.pdf
    • http://sales13-sip-phone.pleasingfood.com/uploads/1/3/0/5/130588762/130588762.html#structural+adjustment+programs+in+kenya+pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://fedoraproject.org/wiki/Licensing/LiberationFontLicense

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003495.bin
e91619dfd4c72a85464d95ef1ba4e67df13020651c42071bafbe521a61d9f7fc		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3495 2652 bytes
font_01_sfnt_off00004078.bin
56d325dad8e535f91c3cf716b9caac4e47cb278e9f588c2f7ad1012183f0345c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4078 7992 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.