Malicious PDF — malware analysis report

Static analysis result for SHA-256 2a560414d27b93db…

MALICIOUS

PDF

54.1 KB Authoring application: PDFedit
MD5: de39ef6ebeb67efdd228d0a75d8f0218 SHA-1: 56a5f50679397ecb8dcfec0d7c8710199981681a SHA-256: 2a560414d27b93db6f079205004d9279378ae85f61e45b750a75330c4d7e1ef1
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file was flagged by multiple heuristics, including a critical PDF_SEO_LINK_FARM rule and a high-confidence ML classifier, indicating malicious intent. The embedded content, though heavily obfuscated, contains a large number of external links, suggesting a link farm or redirection mechanism. The ClamAV detection of 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a phishing or traffic-driving purpose.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.btschusterlaw.com/uploads/1/3/0/7/130775672/627d23501be3a33.pdf
    • http://ghprn.com/uploads/1/3/0/2/130270990/2813637.pdf
    • http://britfinds.com/uploads/1/3/0/7/130775002/rewot_ketudugo_kokepis.pdf
    • http://grupoefad.com/uploads/1/3/0/7/130739202/lidokujuzagurob_zozakazafizalo.pdf
    • http://barringtonmasons.com/uploads/1/3/0/2/130272232/2528962.pdf
    • http://workerscompguide.com/uploads/1/3/0/5/130588442/3342442db8.pdf
    • http://pshswildcatlax.com/uploads/1/3/0/4/130475996/dixoxajepate_fepikanes_samopejigik_jugunonap.pdf
    • http://www.26thwardalderman.com/uploads/1/3/0/7/130739495/pibuzomurunonof.pdf
    • http://cmqi.com/uploads/1/3/0/6/130622023/mikofovix.pdf
    • http://049pledge.com/uploads/1/3/0/6/130620965/juvupe.pdf
    • http://eatdrinkbephilly.com/uploads/1/3/0/6/130604779/modunejuxofiveko.pdf
    • http://studiobrickhouse.net/uploads/1/3/0/3/130323374/9a322f5.pdf
    • http://mta-sts.mail.kinkiosk.com/uploads/1/3/0/4/130483478/zixoxipuxubigu.pdf
    • http://webmail.csungsf.org/uploads/1/3/0/6/130604406/bufakemada_biwewivix_potagatu.pdf
    • http://obrienclan.com/uploads/1/3/0/6/130640144/aa029ee605.pdf
    • http://aliceschristmaselves.com/uploads/1/3/0/5/130550952/ef792557c63408.pdf
    • http://www.thebloggermarket.co.uk/uploads/1/3/0/7/130740513/kujovo.pdf
    • http://mail.realtypartners.madesimplydev.com/uploads/1/3/0/7/130775551/7630229.pdf
    • http://bedbeacon.net/uploads/1/3/0/7/130739371/lenevilapisesu.pdf
    • http://74-123-77-236.mgwnet.com/uploads/1/3/0/8/130814469/130814469.html#antihypertensive+drugs+causing+renal+failure

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000010bf.bin
56e3bfa3f1ec65112bbdc072ed921da6ee6a51c8e2be23b2835cdec8ac55623b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10BF 7808 bytes
font_01_sfnt_off00008b81.bin
4cba7a75720a0d4ce53d0e0c9188210978e9677bbedecb86438bcb9385125657		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8B81 3176 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.