Malicious PDF — malware analysis report

Static analysis result for SHA-256 51d14d527387926a…

MALICIOUS

PDF

45.5 KB Authoring application: GIMP
MD5: c93ec9c3c694023d5df490f30f11957e SHA-1: 43bcfddda4da78a4c489fde9e5f61abf6599a502 SHA-256: 51d14d527387926a1f0f81b23d51503984d55cab65c57d09976f42ea4ac596c3
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of external links to other PDF files hosted on various domains, indicating a link farm or redirection scheme. ClamAV identified this as Pdf.Phishing.TtraffRobotInstall-7605656-0, and a critical heuristic detected a PDF SEO link farm. The document body is heavily obfuscated and unreadable, but the presence of numerous external links suggests a phishing or malicious redirection attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://albertarescue.com/uploads/1/3/0/6/130621490/dumazin-kisasojo-lasufax.pdf
    • http://torqdrft.com/uploads/1/3/0/2/130272254/eb7b5773916.pdf
    • http://sueriffic.com/uploads/1/3/0/5/130544390/9551540.pdf
    • http://bombayfrankiecompany.com/uploads/1/3/0/6/130639408/a5da9e43d234.pdf
    • http://mytourphone.com/uploads/1/3/0/7/130738789/4183088.pdf
    • http://pinemountainlakelodge.com/uploads/1/3/0/3/130313398/nuwojuze_wobunisusamovek.pdf
    • http://tikibravo.com/uploads/1/3/0/8/130813317/92fed73ef900.pdf
    • http://cflawgroup.com/uploads/1/3/0/6/130604482/bekutodaxusese_zigugarex.pdf
    • http://puregreenjuice.com/uploads/1/3/0/3/130313196/xodilumura.pdf
    • http://www.rionheart.com/uploads/1/3/0/9/130969847/nuvoxaleg.pdf
    • http://shopthebarndoorcompany.com/uploads/1/3/0/8/130813931/webigugamasewom_resuxip_viverorutuko.pdf
    • http://thevictressvegan.com/uploads/1/3/0/5/130551051/dekuluwalesa-gabibanomivitol-ruliza-gataxaxurafeti.pdf
    • http://admin.lighthousewoking.org/uploads/1/3/0/7/130738555/tetiko.pdf
    • http://qusociologydepartment.com/uploads/1/3/0/5/130545885/4282329.pdf
    • http://yubeautylounge.com/uploads/1/3/0/5/130550994/kubakugu.pdf
    • http://defiddesign.com.au/uploads/1/3/0/5/130550879/8226448.pdf
    • http://webdisk.cawsab.org/uploads/1/3/0/5/130588821/12a4cd584225.pdf
    • http://breanawrites.com/uploads/1/3/0/2/130289338/21cfb970.pdf
    • http://madisonviplimos.com/uploads/1/3/0/2/130291676/ranabob.pdf
    • http://thomascignomd.com/uploads/1/3/0/4/130490181/junopiguporet.pdf
    • http://conwayduilawyer.com/uploads/1/3/0/7/130739488/d46bef.pdf
    • http://readytoadopt.ca/uploads/1/3/0/7/130775965/f2aaf7fe.pdf
    • http://74-123-79-208.mgwnet.com/uploads/1/3/0/6/130620637/130620637.html#adj+mega+tripar+profile+plus+bundle

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004bf9.bin
d499b6a1a9cdc3146a7d839171cba59a1d3fd66d6387b386c2f0ac9bab5d6867		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4BF9 9696 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.