Malicious PDF — malware analysis report

Static analysis result for SHA-256 4ad5617e953f2efd…

MALICIOUS

PDF

42.3 KB Authoring application: Nitro PDF
MD5: d0a93ebdf268b3bd01711bf99bb8f524 SHA-1: b8769aac91d74616dee23b70c6bddd5853371954 SHA-256: 4ad5617e953f2efd9c534f9222da268a1590c8c4551decb0c33a9a17fcd8b562
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded links, identified by the PDF_SEO_LINK_FARM heuristic, pointing to various domains. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the ML classifier output strongly indicate malicious intent, likely for phishing or distributing further malware. The embedded URLs are the primary indicators of compromise.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://rsllcw.com/uploads/1/3/0/7/130739828/1296158.pdf
    • http://brassybuds.com/uploads/1/3/0/4/130483550/2376641.pdf
    • http://myteamtriumph-ga.org/uploads/1/3/0/2/130288333/2266206.pdf
    • http://www.route66tulsa.org/uploads/1/3/0/7/130775821/dinebun.pdf
    • http://arlencollisioncenter.com/uploads/1/3/0/2/130272582/3096018.pdf
    • http://northshorelemonade.com/uploads/1/3/0/6/130604192/6414419.pdf
    • http://kaukauproductions.com/uploads/1/3/0/5/130540507/lamodosufole_xutubijovav_velen.pdf
    • http://rimrepairdirect.com/uploads/1/3/0/5/130551433/1068647.pdf
    • http://iclubgood.net/uploads/1/3/0/5/130589342/sufijodamiditu.pdf
    • http://elder-well.net/uploads/1/3/0/3/130379612/debijewuxositupe.pdf
    • http://my-healthjournal.com/uploads/1/3/0/6/130604162/99992.pdf
    • http://bradschuck.com/uploads/1/3/0/4/130483491/8426738.pdf
    • http://kathleenmaree.com/uploads/1/3/0/7/130739530/marivamim.pdf
    • http://yourdedicatedtravelagent.com/uploads/1/3/0/8/130814157/bulonuzupafepowuwew.pdf
    • http://creditcoaches.org/uploads/1/3/0/5/130543685/balifagis.pdf
    • http://www.manuelaholban.net/uploads/1/3/0/6/130605168/surunon-ritomexinawemaf.pdf
    • http://www.moorereplacements.net/uploads/1/3/0/7/130775357/4299727.pdf
    • http://monefeldts.com/uploads/1/3/0/2/130270785/mukavareru-femigalifin-bamug.pdf
    • http://psychedynamic.com/uploads/1/3/0/5/130551258/b43d9fb4a3.pdf
    • http://mail.quaidconsultancy.com/uploads/1/3/0/2/130287281/funapoliwowenun.pdf
    • http://www.brickmastermason.com/uploads/1/3/0/5/130588531/pamotubegubusepuzu.pdf
    • http://hardhathomeinspection.com/uploads/1/3/0/5/130542775/130542775.html#decryption+hill+cipher+example
    • http://www.brickmastermason.com/uploads/1/3/0/5/13058

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003bd0.bin
1b526c603320d7ff994eb5c3dce00569cc747b5521f1ad6bc29e94fd7fad4914		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3BD0 8848 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.