Malicious PDF — malware analysis report

Static analysis result for SHA-256 3d283a5fe332acea…

MALICIOUS

PDF

49.9 KB Authoring application: PDF Studio
MD5: fda481f9b07675845c29a92451683333 SHA-1: a23d4fbf2debc6144cf2aaeb4763e0c791b35c98 SHA-256: 3d283a5fe332acea95f705bd0b240577411102ee944fffadbc599ba56f156b7d
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF contains a large number of embedded links to external PDF files, a technique commonly used for SEO poisoning and phishing. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the ML classifier strongly indicate malicious intent. The document body, while containing text about hemoglobin, also embeds URLs that likely lead to further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://gloriaandfrederik.com/uploads/1/3/0/6/130603997/jarulexagog.pdf
    • http://loebclassicallibrary.net/uploads/1/3/0/3/130313198/2216103.pdf
    • http://saskatchewancabinrentals.com/uploads/1/3/0/6/130604498/7291857.pdf
    • http://auntybencookie.com/uploads/1/3/0/2/130271159/fufepugo.pdf
    • http://taylorshurte.com/uploads/1/3/0/4/130489131/zamaj.pdf
    • http://teamelite10u.com/uploads/1/3/0/4/130483422/9116959.pdf
    • http://cinno.ca/uploads/1/3/0/5/130543764/jerazusiramu-derojaweronis.pdf
    • https://tamukesup.weebly.com/uploads/1/3/0/4/130477176/sorozux.pdf
    • http://metalslitter.com/uploads/1/3/0/4/130436410/8295f4.pdf
    • http://allergy.mediutopia.com/uploads/1/3/0/3/130379292/130379292.html#structure+of+hemoglobin+and+myoglobin+ppt

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000011ee.bin
8868c94acdb25a77d8f2dc96a2bb0a172b2dc4cf28f6fb756564d53c1a51f13e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11EE 8180 bytes
font_01_sfnt_off00007d2d.bin
42bfd7ba30eb977b61bf33ee09c358ea2ce39902479aa81cc55ac4d42908e434		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7D2D 3536 bytes
font_02_sfnt_off000088b8.bin
9bd4f0becdecd55aac3f334c4492a779bc4c045d920a3dee53bc143df51fd9e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x88B8 1980 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.