Malicious PDF — malware analysis report

Static analysis result for SHA-256 44d329b824c41941…

MALICIOUS

PDF

38.6 KB Authoring application: Solid Converter PDF
MD5: 2b5daf6ab92241303bf1b40b4bdb3b08 SHA-1: 738c90e86acba56fa6aee5690d92d0c981fdf084 SHA-256: 44d329b824c4194162961c903dadd071cb1c41d1146019af97a18d0c2e50e4ed
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded links to external PDF documents, a technique often used for SEO manipulation or to distribute malicious payloads. ClamAV identified this as Pdf.Phishing.TtraffRobotInstall-7605656-0, and ML classification strongly supports a malicious verdict. The document body itself is heavily obfuscated and appears to be corrupted, providing no clear user-facing lure.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://easyrealestatewebsites.com/uploads/1/3/0/6/130620881/munizaxuvepadisimu.pdf
    • http://monagarciamusic.com/uploads/1/3/0/2/130289719/tinere.pdf
    • http://cleanupga.org/uploads/1/3/0/5/130543148/996b80d38.pdf
    • http://eduexchange.org/uploads/1/3/0/5/130550809/4914267.pdf
    • http://soulshinephotographymacon.com/uploads/1/3/0/5/130539350/futej.pdf
    • http://tradeshowsinarizona.com/uploads/1/3/0/5/130543588/nedem.pdf
    • http://www.alleinarbeiten.de/uploads/1/3/0/7/130775456/pukofe.pdf
    • http://guruofbridge.com/uploads/1/3/0/6/130604576/9357433.pdf
    • http://easypeintures.com/uploads/1/3/0/4/130488282/ef2362.pdf
    • http://www.brothersphotographers.com/uploads/1/3/0/7/130739297/desute.pdf
    • http://mheseries.com/uploads/1/3/0/6/130604693/bekuxaw_rudosimuxogiz.pdf
    • http://stand2serve.net/uploads/1/3/0/4/130491271/0e4b93c406b527a.pdf
    • http://tanjazumanschauen.com/uploads/1/3/0/2/130271243/vomagadimarubid-nipurek-sudasagib-zogelosudov.pdf
    • http://signaturegardens.net/uploads/1/3/0/4/130435546/kopiwakudakidi.pdf
    • http://circlecitytrade.com/uploads/1/3/0/6/130605152/b796c81306715.pdf
    • http://punchingbagselite.com/uploads/1/3/0/8/130813134/1670194.pdf
    • http://personalizedpeeradvocate.com/uploads/1/3/0/6/130639744/621b9c.pdf
    • http://mrsvoigtsclassroom.com/uploads/1/3/0/6/130639439/wunufofesage.pdf
    • http://northwestuu.com/uploads/1/3/0/5/130550693/130550693.html#how+can+alcohol+cause+hepatitis

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003a4d.bin
364622f2fad55acfbd4d2088c8bb6d1be085b8c98a46603f5a112b85197c81b4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3A4D 7536 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.