Malicious PDF — malware analysis report

Static analysis result for SHA-256 25dd73d9fd0cd73e…

MALICIOUS

PDF

40.8 KB Authoring application: Scribus
MD5: 0d0557c127136409aa002c8bc926edc8 SHA-1: 29d99af54d696f2202d59cd698968e0d3cfe5095 SHA-256: 25dd73d9fd0cd73eb98b2b94fcf914f98e1aa3e5a39a34f43222b83415a343e9
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF contains a large number of embedded links to other PDF files, a technique commonly used for SEO poisoning and distributing malicious content. The document body, though heavily obfuscated, contains references to downloading Adobe Flash CS6 Portable, suggesting a lure to trick users into downloading further malicious payloads. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall' further supports the phishing and traffic redirection nature of this file.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://yahonlytimes.com/uploads/1/3/0/3/130323738/mofoxikujiwopuduguz.pdf
    • http://teratype.net/uploads/1/3/0/7/130738823/d084aa6b44be.pdf
    • http://bellabee.org/uploads/1/3/0/3/130323260/6b3f9f2875b7.pdf
    • http://newtrailpioneer.com/uploads/1/3/0/6/130605430/wiwomiliwumug_sizos_zubugigaroxal_muxodevat.pdf
    • http://noahcwhite.com/uploads/1/3/0/7/130739897/8164556.pdf
    • http://beaconclean.com/uploads/1/3/0/5/130551832/6936174.pdf
    • http://mwvhc-nh.org/uploads/1/3/0/5/130588428/fexaposepikumetig.pdf
    • http://hlaa-or.com/uploads/1/3/0/3/130324390/labomudiwakujopos.pdf
    • http://noojoom-swissra.com/uploads/1/3/0/4/130489052/6689655.pdf
    • http://findyoulost.com/uploads/1/3/0/4/130483961/kewoze-xurikadefa.pdf
    • http://syneride.com/uploads/1/3/0/6/130620990/mewufolanuj-wepobes.pdf
    • http://trentriverdesigns.com/uploads/1/3/0/4/130476885/130476885.html#descargar+adobe+flash+cs6+portable+64+bits

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001484.bin
064ed60299198933fae4e0b25e5fdb9a915ce2aae15da5a1ae87b64aded829d5		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1484 8432 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.