Malicious PDF — malware analysis report

Static analysis result for SHA-256 29eafcfe2a5d6567…

MALICIOUS

PDF

42.7 KB Authoring application: pdf-parser
MD5: b11ee181379cd79664eb1293fd6b5d59 SHA-1: 240946022e595604b42d7a8a1068fd9d870f8529 SHA-256: 29eafcfe2a5d6567a901fb2c12262ed0764e5afa3ad150f2c00e6339224983ff
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded URLs pointing to external PDF files, a technique often used for SEO spam or to distribute malicious content. ClamAV identified this as Pdf.Phishing.TtraffRobotInstall-7605656-0, and ML classification strongly supports its malicious nature. The embedded URLs are the primary indicators of malicious activity, suggesting a campaign to redirect users to potentially harmful sites.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://prophecyoutlook.org/uploads/1/3/0/5/130551266/potipawe_fuwububag_pizeji.pdf
    • http://tomisenamakeup.com/uploads/1/3/0/7/130739280/jubikivijeli.pdf
    • http://www.caroce.net/uploads/1/3/0/5/130590122/1bc513c6554050.pdf
    • http://eileenplichta.com/uploads/1/3/0/6/130620574/nepubajurime_wibotidu_lutoj_zudexiwotazam.pdf
    • http://bloompainters.com/uploads/1/3/0/2/130289532/buwejalesibagowewe.pdf
    • http://www.jcfishstand.com/uploads/1/3/0/6/130639997/xutodo_zajuweze_tanadakub.pdf
    • http://lifetrackfinancialadvisors.com/uploads/1/3/0/6/130604856/waganetijilik-fonobezi.pdf
    • http://motorshare.org/uploads/1/3/0/7/130738762/aef8a0f335e26.pdf
    • http://xvalhalla.com/uploads/1/3/0/8/130814754/gifabufojuned.pdf
    • http://mobilegroomersarasota.com/uploads/1/3/0/4/130483811/d264fa981230877.pdf
    • http://jesusisoursheperdministry.com/uploads/1/3/0/7/130740609/16f2dc.pdf
    • http://blackmakeupartistla.com/uploads/1/3/0/6/130639962/a10c55e4.pdf
    • http://myawaribox.com/uploads/1/3/0/4/130483770/sabumababa.pdf
    • http://hazeperformance.com/uploads/1/3/0/5/130551745/29c7eb.pdf
    • http://paradise-kdg.org/uploads/1/3/0/6/130604687/numuf.pdf
    • http://village-life.com/uploads/1/3/0/6/130603978/sobatefipir.pdf
    • http://heritagebrush.com/uploads/1/3/0/6/130620451/xavasivavemolu.pdf
    • http://shoesbynatalia.com/uploads/1/3/0/7/130740066/fusoxuzux_radugaxolokisos.pdf
    • http://sblimexprnce.com/uploads/1/3/0/6/130620818/xupedom.pdf
    • http://livelocalcard.com/uploads/1/3/0/5/130551132/wewuzuze_zabomotal_xekixuduwewute_vemusotigotada.pdf
    • http://alohabrewed.com/uploads/1/3/0/2/130272493/witupakojufesebeze.pdf
    • http://flowalong.com/uploads/1/3/0/5/130540477/f409dc3.pdf
    • http://amh2sl.salon225.com/uploads/1/3/0/6/130621950/130621950.html#pathophysiology+of+hepatitis+b+virus

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004694.bin
15b73ce7719080651434c3ef3ac233159b798f50eaa58362f390c0ec0046d8c1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4694 7596 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.