Malicious PDF — malware analysis report

Static analysis result for SHA-256 2b347d1be05018db…

MALICIOUS

PDF

31.9 KB Authoring application: QPDF
MD5: b5f8cb1f47d3e9b87be1dc68b108b47f SHA-1: 952990c1765898e2638426805c35c2b12cfb2b33 SHA-256: 2b347d1be05018db94bdf0c679f92059e5b6fe97ebd926cc0f84b2d50b12940a
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

This PDF file was flagged by ClamAV as Pdf.Phishing.TtraffRobotInstall-7605656-0 and a machine learning classifier. The document body contains a lure related to 'Ayurveda' and 'Dosha quiz', while the embedded heuristics indicate a link farm designed to redirect users to numerous external PDF files. This suggests a phishing or traffic-driving campaign.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://dmitrithompson.com/uploads/1/3/0/6/130621809/4261790.pdf
    • http://monarchteachernetworkmanitoba.com/uploads/1/3/0/6/130620987/nogud-pejejavabugu.pdf
    • http://silenthighways.com/uploads/1/3/0/5/130588654/83ad33ff3.pdf
    • http://onlinesmdc.com/uploads/1/3/0/3/130313221/d3c9f8d2a2b5.pdf
    • http://drroddysuos.com/uploads/1/3/0/4/130436147/zagakas_xesavovisotap_lovexuzipikofa_dofagafuje.pdf
    • http://flatlandultrarunner.net/uploads/1/3/0/4/130490585/4726495.pdf
    • http://tmt-analytics.com/uploads/1/3/0/7/130740586/luruvopufekit_jifegoveti.pdf
    • http://www.edroidnews.com/uploads/1/3/0/7/130776865/luromebosibo-nuzifegexul-zuduw.pdf
    • http://schumachertitle.com/uploads/1/3/0/6/130604872/8679946.pdf
    • http://www.alliesonthejourney.org/uploads/1/3/0/4/130483886/4479729.pdf
    • http://nysmaplepartridge.com/uploads/1/3/0/7/130776319/xofifusugi-gorupezoxov-sifazazufofodo.pdf
    • http://smciner1.com/uploads/1/3/0/7/130775151/duwipabadezora.pdf
    • http://morrisandsilvester.com/uploads/1/3/0/8/130814009/3427692.pdf
    • http://zhcw.brdge.org/uploads/1/3/0/6/130621950/130621950.html#dosha+quiz+pdf+free

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002323.bin
6c1db2fe5e851f8dedf29e002023b3526eb86938c47845a0a7d0a7882b5d0835		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2323 7960 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.