Malicious PDF — malware analysis report

Static analysis result for SHA-256 4f172b13eab29f54…

MALICIOUS

PDF

71.1 KB Authoring application: Mobipocket Creator
MD5: 32a96095eb7233c3c0bb2a3bfb18a3a5 SHA-1: 5ec9a4b794acb6ca6b6f2e1d4f281963d896540b SHA-256: 4f172b13eab29f54f2f76536407388d7fa627208619e8d024b993d6664ed883a
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 User Execution: Malicious File

The PDF file was flagged by multiple heuristics, including ClamAV and an ML classifier, as malicious. The PDF contains a link farm pointing to numerous external PDF files, suggesting a SEO spam or redirection tactic. The document body, despite being truncated and containing obfuscated content, mentions 'Korean alphabet pronunciation rules' and embeds URLs, reinforcing the idea of a lure to external content. The primary attack pattern appears to be SEO spam or a phishing pretext to drive traffic to malicious sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9946

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://carpetcleaning-phoenix.com/uploads/1/3/0/4/130435654/15a63842c.pdf
    • http://mrhowe.org/uploads/1/3/0/2/130288565/f99c7777.pdf
    • http://eurekaarchitecture.com/uploads/1/3/0/7/130738852/naxud.pdf
    • http://braveangelyoga.com/uploads/1/3/0/5/130588168/2371539.pdf
    • http://michaelshusko.com/uploads/1/3/0/8/130873944/130873944.html#korean+alphabet+pronunciation+rules

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001086.bin
2be04d6f984b7765d94a60b6337e3b91a7df273c1683335b271d0c0586a7f4d4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1086 9236 bytes
font_01_sfnt_off000084f6.bin
b94df823ea9ed9ab6d6af83c82b1f00060be3fdba22f1409cf9b9956075801de		 pdf-font-stream PDF embedded font (sfnt) at offset 0x84F6 17620 bytes
font_02_sfnt_off00009ea4.bin
5278024270de67705d3a5034a26ce2f5e1d9e53f50705cc770b2190155f81e7b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9EA4 6728 bytes
font_03_sfnt_off0000b22b.bin
44c23b12b2368e851c4f1276c58dc2c4742e1e224367c6586b0162f9ec256e55		 pdf-font-stream PDF embedded font (sfnt) at offset 0xB22B 18428 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.