Malicious PDF — malware analysis report

Static analysis result for SHA-256 1f97520db1620a61…

MALICIOUS

PDF

41.1 KB Authoring application: Pdftk
MD5: e3f7a092c9b6ba180c060648b38d8b16 SHA-1: 1183a34a7cfbd99078797654c2e3268ef835ed2c SHA-256: 1f97520db1620a61ef9e3a6397b12df4f0b1f10a058917f4c7163bcca92cd3d9
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded external links, a technique often used for SEO manipulation or to distribute malicious content. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the ML classifier strongly indicate malicious intent. The heuristic 'PDF_SEO_LINK_FARM' confirms the presence of numerous external PDF links, with 'riseupgroup.net' being a dominant host. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://riseupgroup.net/uploads/1/3/0/5/130541462/8905205.pdf
    • http://a1412531xstreamtravel.xsideas.com/uploads/1/3/0/2/130287462/bejapo.pdf
    • http://nounoula.com/uploads/1/3/0/2/130287920/9504905.pdf
    • http://phoenixadjusters.net/uploads/1/3/0/3/130379718/mofezuj_tivaxuloriveg_fetumev.pdf
    • http://yournaturallybrightpatiocovers.com/uploads/1/3/0/5/130547418/gomunalewurim.pdf
    • http://joeblitzstein.net/uploads/1/3/0/2/130274345/kenekekapozid.pdf
    • http://liftoffgames.com/uploads/1/3/0/6/130604114/c80d6d1ac89.pdf
    • http://tillercapitalltd.com/uploads/1/3/0/4/130483396/zevaxi-tunipil.pdf
    • http://iveyvoicestudio.com/uploads/1/3/0/6/130604588/mopap.pdf
    • http://4saules.lv/uploads/1/3/0/5/130544390/7367985.pdf
    • http://goldiefoxcreativeconsulting.com/uploads/1/3/0/7/130739431/08e6832d8d04983.pdf
    • http://docpixelphotography.com/uploads/1/3/0/5/130551197/74621.pdf
    • http://mianduimianshipinqipaiyouxi.br3h.com/uploads/1/3/0/8/130873718/130873718.html#eat+right+for+your+blood+type+o+negative
    • http://nounoula.com/uploads/1/3/0/2/130287920

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000048fc.bin
4bfe23bc12b24366b39b92f8e86ec8c1de8e2c08f539eaa44328d5e79f078a6d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x48FC 7928 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.