Malicious PDF — malware analysis report

Static analysis result for SHA-256 4517818d0dbb6bdf…

MALICIOUS

PDF

111.0 KB Authoring application: PDFedit First seen: 2020-09-07
MD5: f14dd37566788cef7b72ad8b98781d4f SHA-1: 2af315c9918facc76043d32b569869224564d1d1 SHA-256: 4517818d0dbb6bdff4f190485419969d1660dab88e6e331349d62de38bbe64ef
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded URLs pointing to other PDF files, indicative of a link farm or SEO manipulation tactic. ClamAV identified this as Pdf.Phishing.TtraffRobotInstall-7605656-0, and a critical heuristic detected a mass external PDF link farm. The ML classifier also flagged this PDF with high confidence. No scripts were extracted, but the sheer volume of outbound links suggests a malicious intent to redirect users or manipulate search engine results.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://birthingbaby.co.uk/uploads/1/3/0/7/130738534/81c0dc40ace.pdf In PDF document text
    • http://hightowerinspections.com/uploads/1/3/0/5/130588257/xiravasofosixu_jebuxafaru.pdfIn PDF document text
    • http://www.gatosolo.net/uploads/1/3/0/4/130488486/2642122.pdfIn PDF document text
    • http://sno-ops.org/uploads/1/3/0/3/130379921/galoziku_zejejaf.pdfIn PDF document text
    • http://dejavumeridian.com/uploads/1/3/0/6/130604589/5032675.pdfIn PDF document text
    • http://besslerelectric.marketingfactorygroup.com/uploads/1/3/0/6/130604459/1051276.pdfIn PDF document text
    • http://cbulloughinternshipportfolio.com/uploads/1/3/0/6/130605217/kajekiba.pdfIn PDF document text
    • http://diversitybusinessforum.com/uploads/1/3/0/8/130873916/617ed8c3dc2799.pdfIn PDF document text
    • http://thedentistcfo.com/uploads/1/3/0/6/130620321/2089165.pdfIn PDF document text
    • http://daytonconcretecontractors.com/uploads/1/3/0/6/130621250/3496852.pdfIn PDF document text
    • http://www.hybrid-cl.com/uploads/1/3/0/4/130476650/disesiwumi-jawewuwaj.pdfIn PDF document text
    • http://www.michaelbullroberts.ca/uploads/1/3/0/6/130620511/3024099.pdfIn PDF document text
    • http://ledvideolighting.com/uploads/1/3/0/8/130814311/pimugolar.pdfIn PDF document text
    • http://femmetotale.org/uploads/1/3/0/3/130313262/gedilaxuxu.pdfIn PDF document text
    • http://ctcommunications.com/uploads/1/3/0/6/130621243/dusirojiwituze-xexufasin.pdfIn PDF document text
    • http://ntact.net/uploads/1/3/0/7/130775822/8018480.pdfIn PDF document text
    • http://littlesbyloren.com/uploads/1/3/0/6/130604086/jojag.pdfIn PDF document text
    • http://napavalleycharters.com/uploads/1/3/0/6/130622025/8d7e4e0.pdfIn PDF document text
    • http://www.juliayoungcurator.com/uploads/1/3/0/2/130272928/a384b277e9a9007.pdfIn PDF document text
    • http://bibamate.com/uploads/1/3/0/4/130488846/rimupeb.pdfIn PDF document text
    • http://sharoncraryhandwovenrugstapestry.com/uploads/1/3/0/7/130776212/7217331.pdfIn PDF document text
    • http://edheld.org/uploads/1/3/0/3/130313191/8592099.pdfIn PDF document text
    • http://boldexplorations.voyagerwebsites.com/uploads/1/3/1/0/131070940/131070940.html#antibiotic+therapy+of+methicillin-resistant+staphylococcus+aureus+in+critical+careIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://fedoraproject.org/wiki/Licensing/LiberationFontLicenseIn PDF document text

Related samples 2

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000017f0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x17F0 9884 bytes
SHA-256: e4e2a02f74f4549abeb07a898953af309612c9a8d773a274031799a95f403b94
font_01_sfnt_off0000eb60.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEB60 2928 bytes
SHA-256: e0a8c7e647b9019d8696481ff15ec2bff862afc34b11810707fccc06eb98678b

Open this report in the interactive analyzer, or submit your own file for analysis.