Malicious PDF — malware analysis report

Static analysis result for SHA-256 19a659b96e49fb12…

MALICIOUS

PDF

33.9 KB Authoring application: ImageMagick
MD5: 9ae333d7fd4319eb30a20432aafa93e5 SHA-1: 59cb99746165c8e2248ac830a66e9795b8615d2c SHA-256: 19a659b96e49fb1265aa4feae663214a2d63a43f055866201976a12f0618f85a
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of embedded URLs pointing to other PDF files, a technique often used for SEO manipulation or to distribute further malicious content. ClamAV detected this as Pdf.Phishing.TtraffRobotInstall, and a machine learning classifier also flagged it as malicious. The embedded URLs are the primary IOCs, suggesting a phishing or content distribution campaign.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://english-log-cabins.com/uploads/1/3/0/7/130738764/duwok-vupimi-zidus.pdf
    • http://www.vincentdigeronimo.com/uploads/1/3/0/6/130605369/judedobefid_wivezugakipa_pilatupin.pdf
    • http://wheredoyouwanttogoforlunch.com/uploads/1/3/0/6/130620391/putomadifajejumol.pdf
    • http://albertosslc.com/uploads/1/3/0/8/130873944/6778499.pdf
    • http://tbarandelahairstudio.com/uploads/1/3/0/5/130543059/nijori_kanewu.pdf
    • http://gogocake.com/uploads/1/3/0/4/130476066/zotubusefojasok-dukosugara.pdf
    • http://beckett.photos/uploads/1/3/0/6/130605115/1090727.pdf
    • http://goalsettingchallenge.com/uploads/1/3/0/6/130621915/4064350.pdf
    • http://mxe.feedingmyohana.com/uploads/1/3/0/5/130551670/98812.pdf
    • http://buystrathconahomes.com/uploads/1/3/0/5/130588349/5924116.pdf
    • http://h387d.slpny.com/uploads/1/3/0/5/130545327/130545327.html#critical+values+for+two+tailed+t+test
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://fedoraproject.org/wiki/Licensing/LiberationFontLicense

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002609.bin
4d9ec2aec8f1ca6bebe1b56492fd55a77bba3a6e98efb76508c1b835d4eb9912		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2609 2860 bytes
font_01_sfnt_off000031e8.bin
479758f73dc5c00ebef09e868176b4f588bfaa3a177bbd35c863bc95bc8c8c56		 pdf-font-stream PDF embedded font (sfnt) at offset 0x31E8 6592 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.