PDF malware analysis — malicious · 4517818d0dbb6bdf

MALICIOUS

PDF

111.0 KB Authoring application: PDFedit

MD5: f14dd37566788cef7b72ad8b98781d4f SHA-1: 2af315c9918facc76043d32b569869224564d1d1 SHA-256: 4517818d0dbb6bdff4f190485419969d1660dab88e6e331349d62de38bbe64ef

150 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded URLs pointing to other PDF files, indicative of a link farm or SEO manipulation tactic. ClamAV identified this as Pdf.Phishing.TtraffRobotInstall-7605656-0, and a critical heuristic detected a mass external PDF link farm. The ML classifier also flagged this PDF with high confidence. No scripts were extracted, but the sheer volume of outbound links suggests a malicious intent to redirect users or manipulate search engine results.

Machine Learning

Nyx PDF Classifier malicious score 0.9996

Heuristics 3

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://birthingbaby.co.uk/uploads/1/3/0/7/130738534/81c0dc40ace.pdf
- http://hightowerinspections.com/uploads/1/3/0/5/130588257/xiravasofosixu_jebuxafaru.pdf
- http://www.gatosolo.net/uploads/1/3/0/4/130488486/2642122.pdf
- http://sno-ops.org/uploads/1/3/0/3/130379921/galoziku_zejejaf.pdf
- http://dejavumeridian.com/uploads/1/3/0/6/130604589/5032675.pdf
- http://besslerelectric.marketingfactorygroup.com/uploads/1/3/0/6/130604459/1051276.pdf
- http://cbulloughinternshipportfolio.com/uploads/1/3/0/6/130605217/kajekiba.pdf
- http://diversitybusinessforum.com/uploads/1/3/0/8/130873916/617ed8c3dc2799.pdf
- http://thedentistcfo.com/uploads/1/3/0/6/130620321/2089165.pdf
- http://daytonconcretecontractors.com/uploads/1/3/0/6/130621250/3496852.pdf
- http://www.hybrid-cl.com/uploads/1/3/0/4/130476650/disesiwumi-jawewuwaj.pdf
- http://www.michaelbullroberts.ca/uploads/1/3/0/6/130620511/3024099.pdf
- http://ledvideolighting.com/uploads/1/3/0/8/130814311/pimugolar.pdf
- http://femmetotale.org/uploads/1/3/0/3/130313262/gedilaxuxu.pdf
- http://ctcommunications.com/uploads/1/3/0/6/130621243/dusirojiwituze-xexufasin.pdf
- http://ntact.net/uploads/1/3/0/7/130775822/8018480.pdf
- http://littlesbyloren.com/uploads/1/3/0/6/130604086/jojag.pdf
- http://napavalleycharters.com/uploads/1/3/0/6/130622025/8d7e4e0.pdf
- http://www.juliayoungcurator.com/uploads/1/3/0/2/130272928/a384b277e9a9007.pdf
- http://bibamate.com/uploads/1/3/0/4/130488846/rimupeb.pdf
- http://sharoncraryhandwovenrugstapestry.com/uploads/1/3/0/7/130776212/7217331.pdf
- http://edheld.org/uploads/1/3/0/3/130313191/8592099.pdf
- http://boldexplorations.voyagerwebsites.com/uploads/1/3/1/0/131070940/131070940.html#antibiotic+therapy+of+methicillin-resistant+staphylococcus+aureus+in+critical+care
- http://femmetotale.org/uploads/1/3/0/3/130313262/gedilaxuxu

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000017f0.bin` `e4e2a02f74f4549abeb07a898953af309612c9a8d773a274031799a95f403b94`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x17F0	9884 bytes
`font_01_sfnt_off0000eb60.bin` `e0a8c7e647b9019d8696481ff15ec2bff862afc34b11810707fccc06eb98678b`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xEB60	2928 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.