Malicious PDF — malware analysis report

Static analysis result for SHA-256 1bc9baae35919a6b…

MALICIOUS

PDF

38.5 KB Authoring application: PDFedit
MD5: ea53217263bec268bd25869830a4c6fc SHA-1: f09ad542ba7c7a82df5cbceb68e90ee4885c4cbd SHA-256: 1bc9baae35919a6bc208200b8976c77054eef7fd265cdc78e72a9b191849c525
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF contains a link farm pointing to numerous external PDF files, a common technique for SEO poisoning and phishing. The embedded text suggests a lure related to aviation mechanic practice tests, likely intended to trick users into downloading further malicious content. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall' further supports a phishing and redirection-based attack.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://pasoibericotrade.com/uploads/1/3/0/2/130291582/184e8eef2.pdf
    • http://www.hydeconsulting.co/uploads/1/3/0/2/130291589/detewufibazosu.pdf
    • http://azpoloassn.com/uploads/1/3/0/4/130435569/82ee6cb2a4eaa32.pdf
    • http://cdn-5.newenglandlighthouses.net/uploads/1/3/0/7/130775455/b54d98f69d0dc.pdf
    • http://mydanielswaterfrontcondo.com/uploads/1/3/0/6/130621841/vupililoma.pdf
    • http://shirleyxli.com/uploads/1/3/0/6/130604370/7275258.pdf
    • http://terapiaregresiva.org/uploads/1/3/0/6/130621127/puwokedipevuv-buwavusene-mudonefo-zitoreru.pdf
    • http://pressurewashingtorrance.com/uploads/1/3/0/6/130622111/vafenajuribi-masofenupebilik-dozabazosowimu.pdf
    • http://monetki.website/uploads/1/3/0/7/130776577/9358768.pdf
    • http://michaeldylanferrara.com/uploads/1/3/0/8/130814066/fagetowat.pdf
    • http://videoglyph.org/uploads/1/3/0/5/130589384/9565147.pdf
    • http://midiowaworkingdog.com/uploads/1/3/0/5/130551720/ketoropon.pdf
    • http://atwliving.online/uploads/1/3/0/6/130604924/e6f142a4e13f153.pdf
    • http://camphopeless.io/uploads/1/3/0/6/130603982/xiwuralininekosu.pdf
    • http://nataliadgrafica.com/uploads/1/3/0/6/130639852/7343240.pdf
    • http://www.anaeugeniophotography.org/uploads/1/3/0/6/130604903/togosomago-biwinibasiwo.pdf
    • http://cpanel.manchesterbusinessradio.co.uk/uploads/1/3/0/4/130478433/9700543.pdf
    • http://checkthem.in/uploads/1/3/0/6/130604179/wirodafiberaze_tulimazeg_boris_puzezijusixoza.pdf
    • http://therectum.net/uploads/1/3/0/6/130621155/ketinakemewufa-jobekupirudanud-tipof-togup.pdf
    • http://virgooptiks.com/uploads/1/3/0/7/130739107/2f1c2f05b8b6.pdf
    • http://deathhack.com/uploads/1/3/0/6/130639854/mefabofagekil.pdf
    • http://g3kqq2.bdgct.com/uploads/1/3/0/5/130543377/130543377.html#airframe+and+powerplant+practice+test+online

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003335.bin
0979e85bc5a61ec1816ce0112b2c815e68bb068f80189377a4f362452716e1e3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3335 8620 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.