Malicious PDF — malware analysis report

Static analysis result for SHA-256 1c240a812f950a0c…

MALICIOUS

PDF

40.7 KB Authoring application: ImageMagick
MD5: abe830afaf530731938efaf1fc4a62cc SHA-1: 59b0efba7a6cc473a52c6767410100f0dbf34267 SHA-256: 1c240a812f950a0c1e4249581f969fd48fc15ff636f4361d9f07b39b6bb7dfe5
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded links to external PDF files hosted on various domains, as indicated by the PDF_SEO_LINK_FARM heuristic. This suggests a phishing or redirection campaign. The ClamAV detection as Pdf.Phishing.TtraffRobotInstall-7605656-0 further supports a malicious intent. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://lexgurst.com/uploads/1/3/0/5/130551727/genomi-rumujofaz.pdf
    • http://nh-dreamhomes.com/uploads/1/3/0/7/130738972/kemizonakopedu.pdf
    • http://www.shopsuper-nova.com/uploads/1/3/0/5/130541424/4415272.pdf
    • http://shannondriscol.com/uploads/1/3/0/6/130604812/53721.pdf
    • http://www.tacaccountants.com/uploads/1/3/0/7/130738639/busaxufepez_rixilu_razaj.pdf
    • http://www.uem-iee.org/uploads/1/3/0/6/130620555/kupare.pdf
    • http://www.usairborneforces.net/uploads/1/3/0/5/130589070/5111478.pdf
    • http://deltagoldoffer.com/uploads/1/3/0/8/130813427/menakeboregelewoz.pdf
    • http://usedforklifttrucks.org/uploads/1/3/0/2/130272388/a0134263.pdf
    • http://swingcityvolleyball.com/uploads/1/3/0/8/130874474/471d64772a91a.pdf
    • http://12utct.com/uploads/1/3/0/6/130620957/b3aff92ead5.pdf
    • http://eugeneylee.com/uploads/1/3/0/2/130273738/7999509.pdf
    • http://routre.com/uploads/1/3/0/7/130775762/d201c904847.pdf
    • http://lingeriestoresplano.net/uploads/1/3/0/5/130590265/810035.pdf
    • http://link2yoo.net/uploads/1/3/0/6/130639765/5222868.pdf
    • http://catchnrelease.org/uploads/1/3/0/7/130776076/pixunejotibanojifusa.pdf
    • http://chitchatchan.com/uploads/1/3/0/6/130621187/740166.pdf
    • http://natationlaval.com/uploads/1/3/0/5/130539185/nusurikikula.pdf
    • http://vapeeco.com/uploads/1/3/0/5/130542977/aca2fb29f17.pdf
    • http://rsllcw.com/uploads/1/3/0/5/130550772/fazakomuwewonoj.pdf
    • http://k9recreation.com/uploads/1/3/0/7/130775031/3389338.pdf
    • http://tuxebase.com/uploads/1/3/0/7/130776503/nubagagasi.pdf
    • http://irisdealsourcing.co.uk/uploads/1/3/0/6/130640021/xuwefagabaz-wurunifizur-fadejogaw-raduwotoz.pdf
    • http://taxauctiontitle.com/uploads/1/3/0/3/130313053/ritilaxefopunad.pdf
    • http://mortgageskout.com/uploads/1/3/0/2/130289535/1059506.pdf
    • http://chloral21.pleasingfood.com/uploads/1/3/0/6/130603710/130603710.html#endometrial+cancer+staging+radiographics

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002ecd.bin
41d5c9cb4d60b7530e3cfd93a78efd430fe179aa57a8296e74fb8a971da4b0ee		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2ECD 2600 bytes
font_01_sfnt_off00003a51.bin
da4288872d9254e751a4e8dea9787c661170823a42ef76a079bb2cdbc8334db8		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3A51 8000 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.