PDF malware analysis — malicious · 341390a670867ac5

MALICIOUS

PDF

48.0 KB Authoring application: PDF Studio

MD5: 56ad2835c052a3a187ccd5a7eb096aa4 SHA-1: 03d8312b17b00fd476fc3ac06c50b944ae9e43a7 SHA-256: 341390a670867ac5d0bd57d329bd0b6abe8ff11b17387fe487538b477beadde7

152 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded links to external PDF files, a technique often used for SEO manipulation or to distribute further malicious content. ClamAV identified this as Pdf.Phishing.TtraffRobotInstall, and a machine learning classifier also flagged it as malicious. The embedded URLs suggest a phishing or spam campaign aiming to drive traffic to numerous sites.

Machine Learning

Nyx PDF Classifier malicious score 0.9988

Heuristics 3

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://2017newenergysummit.com/uploads/1/3/0/6/130621031/tuvibazanisisob.pdf
- http://floridahelicoptertours.com/uploads/1/3/0/6/130621651/fc8804ae11f5f.pdf
- http://4therestofus.com/uploads/1/3/0/7/130776241/8653386.pdf
- http://3dstereopad.com/uploads/1/3/0/7/130776015/jexigebivate.pdf
- http://diasporaleaders.com/uploads/1/3/0/7/130739653/pulokefukin.pdf
- http://cpanel.abandonhopebook.com/uploads/1/3/0/6/130604429/4679249.pdf
- http://rwgallery.com/uploads/1/3/0/6/130620275/mofuser.pdf
- http://arizonajews4justice.org/uploads/1/3/0/2/130288326/rukukil.pdf
- http://gracefulwarri0r.com/uploads/1/3/0/6/130621915/3117832.pdf
- http://mitsubishisplitac.com/uploads/1/3/0/5/130539002/59e653.pdf
- http://myulrika.com/uploads/1/3/0/6/130604151/92e261.pdf
- http://elvination.org/uploads/1/3/0/4/130479082/18a949.pdf
- http://e-bikerepair.com/uploads/1/3/0/2/130271126/kareteruwagil.pdf
- http://emily-dirks.com/uploads/1/3/0/4/130489776/tapinuritojumonukawa.pdf
- http://enyao-int.com/uploads/1/3/0/2/130288338/felajodege-sadigeti-gugam.pdf
- http://sgadventures.net/uploads/1/3/0/7/130776007/figox-rugorudunoz-punar.pdf
- http://annemariabello.com/uploads/1/3/0/5/130544385/399c776.pdf
- http://elevationdomains.com/uploads/1/3/0/6/130639811/4890845.pdf
- http://www.sa7ant.com/uploads/1/3/0/6/130621124/7133854.pdf
- http://photography.kathleenkeenan.com/uploads/1/3/0/6/130604254/67fb5aa9.pdf
- http://moodage.net/uploads/1/3/0/4/130476161/tamerup.pdf
- http://revivegarb.com/uploads/1/3/0/6/130605390/gotoz_bexazabat_serevejuboxek.pdf
- http://sergioalvares.com/uploads/1/3/0/7/130776754/nisez.pdf
- http://www.thebluecollardaughtersd.com/uploads/1/3/0/6/130603789/zuvuk.pdf
- http://www.howeymusicseries.com/uploads/1/3/0/7/130739088/7706827.pdf
- http://74-123-73-116.mgwnet.com/uploads/1/3/0/4/130488470/130488470.html#additional+mathematics+igcse+notes
- http://dejavu.sourceforge.net
- http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00003e04.bin` `779aa567746046747dac965df7fdfb06ff632674a0a99ce247a327bf89f0fa63`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x3E04	16036 bytes
`font_01_sfnt_off00005555.bin` `8e6fd8358938db9916d9bc7110368fddbc97da4286593a894cdf4383960bac93`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x5555	8668 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.