Malicious PDF — malware analysis report

Static analysis result for SHA-256 47e92e5797dbda51…

MALICIOUS

PDF

40.5 KB Authoring application: Adobe PDF Library 9.0
MD5: 01341411b3b1db3e8d1697a909b69e71 SHA-1: e6fc65137109ed950ad751b9bdbaf1cb82d5c66e SHA-256: 47e92e5797dbda5129dc48ee9b7b577e88285c95eb6d1a6f3666c51c6f73bb24
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded external links, as indicated by the PDF_SEO_LINK_FARM heuristic. ClamAV also detected this as Pdf.Phishing.TtraffRobotInstall-7605656-0. The primary function appears to be redirecting users to a network of websites, likely for phishing or malicious content distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://stjohnlutheranruma.com/uploads/1/3/0/2/130287984/ruwiwiso.pdf
    • http://charlotteconsciousconnections.com/uploads/1/3/0/7/130739190/4eedbfa194d97c.pdf
    • http://coachrenee2u.com/uploads/1/3/0/3/130323255/1237627.pdf
    • http://nordicatravel.net/uploads/1/3/0/7/130738748/gofip_noboponerida.pdf
    • http://nammoi.net/uploads/1/3/0/3/130379921/notonisebalanin_dinelitew_fowivakewop_wodoxunetekibog.pdf
    • http://hostmaster.audiomach.co.uk/uploads/1/3/0/8/130874530/nemorab.pdf
    • http://elysian.support/uploads/1/3/0/2/130289803/40d2ecc6cb.pdf
    • http://marcandrethibault.com/uploads/1/3/0/6/130604903/3145a0b5853969c.pdf
    • http://inkofficial.com/uploads/1/3/0/7/130775242/9481636.pdf
    • http://habeebsquared.info/uploads/1/3/0/4/130476493/gurewixupi-wifibopoxa.pdf
    • http://ginettelaw.com/uploads/1/3/0/7/130739147/4199967.pdf
    • http://northwestpetroleum.com/uploads/1/3/0/6/130621665/padig.pdf
    • http://giantsizedannual.com/uploads/1/3/0/4/130483811/4353159.pdf
    • http://hillsmixtape.co.uk/uploads/1/3/0/7/130739261/3fe5d8a25.pdf
    • http://varcoallied.com/uploads/1/3/0/6/130639467/248810.pdf
    • http://lawyerliving.com/uploads/1/3/0/7/130738622/039763d8.pdf
    • http://civiccoalition-jerusalem.org/uploads/1/3/0/5/130540037/74249e1fa23b1c.pdf
    • http://de.janrosenow.com/uploads/1/3/0/4/130489627/jifivi_wonuzozovesamo_safen.pdf
    • http://everysinglequestion.com/uploads/1/3/0/5/130539797/ripubazateletokefagu.pdf
    • http://midnightepiphanyband.net/uploads/1/3/0/6/130620407/bubunirosiroli.pdf
    • http://santexrealestate.com/uploads/1/3/0/6/130639467/5e26314c16cce.pdf
    • http://hot100project.com/uploads/1/3/0/5/130588532/zowipixuxo.pdf
    • http://thetechgrok.com/uploads/1/3/0/8/130874067/6752324.pdf
    • http://nwapetgrooming.com/uploads/1/3/0/3/130323164/fabixi_foladaxexuvo_biparimexoseb_tuwesovedinim.pdf
    • http://portraits.meliraphoto.com/uploads/1/3/0/4/130476917/sobuwagivorej.pdf
    • http://thefivemilliondollarbook.stefanaarnio.com/uploads/1/3/0/2/130271011/130271011.html#marvel+civil+war+comics+for+sale

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003a66.bin
a55e1afabaa8d0dd0aa73a47edbd218a7b07d03d590936ea7afec428d6fe4617		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3A66 7688 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.