Malicious PDF — malware analysis report

Static analysis result for SHA-256 1a95f760d4674399…

MALICIOUS

PDF

39.8 KB Authoring application: QPDF
MD5: f593cc16325f8273ed6f03fd8f694555 SHA-1: b9f05d418e66937055f377d02da4a2d149698fb9 SHA-256: 1a95f760d467439930729406b6aa7e315929d215eaca92b3e9199435f0f9879e
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic, pointing to other PDF files hosted on various domains. This suggests a link farm or a distribution mechanism for further malicious content. The ClamAV detection as Pdf.Phishing.TtraffRobotInstall-7605656-0 further supports a malicious classification. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://plantcityhomesforsale.net/uploads/1/3/0/7/130739897/6771162.pdf
    • http://kitchensdoorsanddrawers.com/uploads/1/3/0/5/130541023/3254270.pdf
    • http://insidedentalequipment.com/uploads/1/3/0/8/130874264/tuwadizoso_tilumapo_bawomujez_vepunub.pdf
    • http://dimensionalfinancialservices.com/uploads/1/3/0/3/130379379/kikivupi-gifunim-witixurafimaf.pdf
    • http://session9photography.com/uploads/1/3/0/7/130776077/1798263.pdf
    • http://www.vapes4veterans.com/uploads/1/3/0/5/130588931/vegilel.pdf
    • http://naughtybottom.net/uploads/1/3/0/2/130274098/e2f56fd4f6557.pdf
    • http://missionalentrepreneur.com/uploads/1/3/0/5/130550833/dulem.pdf
    • http://thetrixxband.com/uploads/1/3/0/5/130540085/4743002.pdf
    • http://vacavillelimos.com/uploads/1/3/0/5/130543106/3016680.pdf
    • http://seattleyouthbaseball.com/uploads/1/3/0/4/130492127/8875cd9c703343e.pdf
    • http://pdxart.net/uploads/1/3/0/8/130813577/janunesulasok.pdf
    • http://jnrconstruction.net/uploads/1/3/0/7/130739048/daludeba.pdf
    • http://jeaninewhiteunlockinggreatness.com/uploads/1/3/0/2/130291561/mumirebir-menadafa-dejadodajeveta-devim.pdf
    • http://astaplescarpenterforhireinc.com/uploads/1/3/0/4/130476035/wimalumilowugawi.pdf
    • http://axispoint.co/uploads/1/3/0/4/130490053/1268189.pdf
    • http://rampantgames.net/uploads/1/3/0/6/130640107/zelagegoluraxaj_napevovuditu.pdf
    • http://nzbriards.com/uploads/1/3/0/2/130288757/masujofamuxuk.pdf
    • http://kid-o-quotes.com/uploads/1/3/0/6/130621552/6237398.pdf
    • http://919.bpmtc.com/uploads/1/3/0/4/130483804/130483804.html#email+sending+resume+and+cover+letter+sample
    • http://dimensionalfinancialservices.com/uploads/1/3/0/3/130379379/kikivupi-gifu

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003bad.bin
9286eae67fd127d575ad390aad5d0917c503b1e31c4e567c18a571fb0fedb479		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3BAD 8308 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.