Malicious PDF — malware analysis report

Static analysis result for SHA-256 29160922bf124bc2…

MALICIOUS

PDF

37.2 KB Authoring application: Mobipocket Creator
MD5: cf7b87734ecc86d398e74b9bff20cf8d SHA-1: 607c4b0763bb4fa9ed0103e229ab31de4e389ae9 SHA-256: 29160922bf124bc27dd4079f4743e1d21dd14c9de402a277c72cf4e3b7918645
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded URLs pointing to external PDF files, a technique often used for SEO spam or to distribute malicious payloads. ClamAV identified this as 'Pdf.Phishing.TtraffRobotInstall-7605656-0', and ML classification strongly indicated maliciousness. The document body itself appears to be corrupted or contains obfuscated text, but the primary malicious activity is the link farm.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.robertogarzabarbosa.com/uploads/1/3/0/6/130604869/8ab8ce5c3bef.pdf
    • http://thehandymanhelper.com/uploads/1/3/0/6/130603789/jutuwepenenu.pdf
    • http://www.overthecreek.blog/uploads/1/3/0/5/130543093/1572000.pdf
    • http://mohannadgharaibeh.com/uploads/1/3/0/7/130776599/tilaniba.pdf
    • http://gastonmarijuanalawyer.com/uploads/1/3/0/5/130543494/305948.pdf
    • http://xileart.com/uploads/1/3/0/8/130874139/e797bfd.pdf
    • http://kytephotography.com/uploads/1/3/0/8/130814216/3565339.pdf
    • http://laurencoletta.org/uploads/1/3/0/7/130776493/94a5be93506216.pdf
    • http://mistysaromaticboutique.com/uploads/1/3/0/7/130738871/a2fe44de0.pdf
    • http://goodbyesonline.com/uploads/1/3/0/4/130494478/jatebixepopilun.pdf
    • http://www.palmettochapterofahna.org/uploads/1/3/0/5/130551362/da09aebcd.pdf
    • http://orlandoorchards.com/uploads/1/3/0/7/130739294/pituxukenal_nodezaperaguwi_lokijurepojeti.pdf
    • http://whatthepeoplethink.co.uk/uploads/1/3/0/7/130740389/jizob_dudiludobi_gimilu_sakapowegedu.pdf
    • http://orendagametables.info/uploads/1/3/0/5/130543545/8ccb0d7ba.pdf
    • http://limitlessdrive.net/uploads/1/3/0/6/130639946/93507d.pdf
    • http://elemenostudios.com/uploads/1/3/0/6/130621916/e170c9ecd1b343.pdf
    • http://unspoiledpodcasts.com/uploads/1/3/0/6/130639861/5904564.pdf
    • http://fallingoctoberproductions.com/uploads/1/3/0/6/130604215/7d75a.pdf
    • http://d5i81.slpny.com/uploads/1/3/0/7/130740117/130740117.html#sindrome+de+ehlers+danlos+tipo+4+pdf

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000342f.bin
3176eedb81c78bfd4ff668553519d7520a76e735d4a2c0d3968c3a74451bf47c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x342F 8276 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.