Malicious PDF — malware analysis report

Static analysis result for SHA-256 4de9255984c42709…

MALICIOUS

PDF

55.8 KB Authoring application: Mobipocket Creator
MD5: 98bbc4c6037516bc97662c5b96c1b38f SHA-1: 1b8791c6b03c690913e3c51f225789bd0e0b44b4 SHA-256: 4de9255984c4270964163becc2095febaaa6bfb9d06f3ad168b635a001bba8cc
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded links to external PDF files, a technique often used for SEO manipulation or to distribute malicious content. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the ML classifier output strongly indicate malicious intent. No scripts were extracted from this sample, but the structure and URL distribution suggest a phishing or redirection campaign.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://amityschuyler.com/uploads/1/3/0/4/130476607/577792.pdf
    • http://cpanel.traceyfox.co.uk/uploads/1/3/0/7/130776074/gifan.pdf
    • http://bgspecancandy.com/uploads/1/3/0/2/130289387/989ed86547.pdf
    • http://twotwentytwoshop.com/uploads/1/3/0/8/130873737/jozore_ladur_peximepixizuv_lalesadopixiku.pdf
    • http://nkfitsquad.com/uploads/1/3/0/6/130620389/7fb73e6154b0.pdf
    • http://usermarketing101.com/uploads/1/3/0/5/130589198/d2a899c5145097b.pdf
    • http://root.920cattle.com/uploads/1/3/0/8/130873979/6856630.pdf
    • http://newinsightfss.org/uploads/1/3/0/4/130476671/gevekuwitipimupo.pdf
    • http://joy-fully.us/uploads/1/3/0/7/130739343/3871517.pdf
    • http://multifaithstorytelling.org/uploads/1/3/0/7/130775714/topebeb-sezugag-vixab.pdf
    • http://pattyhawkins.us/uploads/1/3/0/5/130551935/xemekaxubadeke.pdf
    • http://modernparentingnetwork.com/uploads/1/3/0/6/130639551/3393597.pdf
    • http://windowfarms.info/uploads/1/3/0/5/130589180/mepijesotajixis.pdf
    • http://twofacesonefist.com/uploads/1/3/0/2/130270945/af86c7f0f1916a.pdf
    • http://show-case-pss.be/uploads/1/3/0/5/130551809/xanokagabozi.pdf
    • http://longdistancevoter.com/uploads/1/3/0/4/130488414/4003621.pdf
    • http://lynnesimpson.net/uploads/1/3/0/5/130588318/7b65d30.pdf
    • http://mohamoudegal.com/uploads/1/3/0/8/130813913/rizak-wifosatetajezib.pdf
    • http://askwiseguys.com/uploads/1/3/0/6/130621788/pevigo.pdf
    • http://britemoonmarketing.com/uploads/1/3/0/5/130552106/5481521.pdf
    • http://www.iotaphilambdanorfolk.gammaxiques.org/uploads/1/3/0/5/130589396/130589396.html#atharva+veda+pdf+gujarati

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000045c4.bin
1723f1ced37cc89d69e30f3df6281c5e5fb8989544fd4587aa75b00c91af2fd0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x45C4 1388 bytes
font_01_sfnt_off00004f7b.bin
9cb4104f38aeff685eee7141031eb56c597601c4e39df94899ab127c7b78d95f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4F7B 15424 bytes
font_02_sfnt_off00007b3f.bin
58519da94585b6f93ed3dcc2d480d114f4d3f79d238866daf69bfefd3f583b30		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7B3F 7980 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.