Malicious PDF — malware analysis report

Static analysis result for SHA-256 28ddfbfce9176534…

MALICIOUS

PDF

49.0 KB Authoring application: PDFedit
MD5: fbbda38a1ea4f38092fc721738847c26 SHA-1: ad7086e63bc1c0b22803c114cc2c5868831f0e59 SHA-256: 28ddfbfce91765345c9043c411d9be7a155b72368da81bb11b8672866a0ca89d
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded URLs pointing to external PDF documents, characteristic of a link farm used for SEO poisoning or phishing. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the ML classifier's high confidence score further support malicious intent. The document body, though heavily obfuscated, suggests a 'study report' lure. The primary attack pattern involves redirecting users to a network of compromised or malicious websites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cosmetology.studio/uploads/1/3/0/6/130621727/31515c634af6b1.pdf
    • http://mldreamscape.com/uploads/1/3/0/4/130476452/dosesepatudo.pdf
    • http://memfeet.com/uploads/1/3/0/4/130489019/juzawitaraxufi_tulexusofuba.pdf
    • http://radiantlifeacademy.org/uploads/1/3/0/5/130550836/sujikurex.pdf
    • http://magnetminders.com/uploads/1/3/0/6/130603710/gafoxupa.pdf
    • http://shashekchiropractic.com/uploads/1/3/0/6/130604759/rexanuvaxoxunu.pdf
    • http://crossfitswage.com/uploads/1/3/0/5/130551219/4173c1864a1.pdf
    • http://nyjincho.com/uploads/1/3/0/6/130620532/6dc99.pdf
    • http://www.thomasconnection.com/uploads/1/3/0/6/130604006/gumefuditujudu.pdf
    • http://mountviewhotelratnapura.com/uploads/1/3/0/8/130814101/ce5b42.pdf
    • http://oxbowsandmeanders.com/uploads/1/3/0/2/130289410/8877069.pdf
    • http://www.terrimiles.co.uk/uploads/1/3/0/2/130272336/vogeb-tivakofeg.pdf
    • http://sancarloshotel-portuguese.devsite-1.com/uploads/1/3/0/2/130272603/130272603.html#excipient+compatibility+study+report

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000065e9.bin
0778cff10d0385a970664a4649c5e1cbe8c59fecda9b7d7eb92b63e42656303d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x65E9 9080 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.