Malicious PDF — malware analysis report

Static analysis result for SHA-256 54e4569edd075af5…

MALICIOUS

PDF

50.3 KB Authoring application: SWFTools
MD5: 0afccc62adaad8df0dd51ead0c407f53 SHA-1: d5e02aa12e9cbfaa372e897c59fb99d7efd5d48a SHA-256: 54e4569edd075af5f17a45d1b822f79486cbbb5a8735877d58ff5eaf9b312e03
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF was flagged by multiple heuristics, including a critical PDF_SEO_LINK_FARM rule indicating a mass of external PDF links, and a ClamAV detection for 'Pdf.Phishing.TtraffRobotInstall'. The embedded URLs suggest a phishing or content distribution scheme. The document body contains garbled text, indicating it is not intended for human readability and likely serves as a container for malicious links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://artofmoses.com/uploads/1/3/0/5/130588714/gujixolorupukigo.pdf
    • http://beyoncebus.com/uploads/1/3/0/8/130874352/zebopovepawexunewi.pdf
    • http://nihaostyle.com/uploads/1/3/0/6/130604520/9218398.pdf
    • http://tidewaterathletics.com/uploads/1/3/0/6/130605493/zesusifo-jedimizano-buwikifigi-kewemab.pdf
    • http://imrsv-x.net/uploads/1/3/0/5/130589171/sojukusidija-fapigowi-kufuw-votawipo.pdf
    • http://tidalwavesswim.com/uploads/1/3/0/4/130483603/7172755.pdf
    • http://poeonline.net/uploads/1/3/0/4/130475980/tuwegowisuxa-sovigererav.pdf
    • http://al-nusr.net/uploads/1/3/0/7/130776724/151850.pdf
    • http://endoscopecabinet.com/uploads/1/3/0/8/130813992/mugaxikexolob.pdf
    • http://crystalmclainarts.com/uploads/1/3/0/5/130551094/391919ab3b0.pdf
    • http://shamusozmen.com/uploads/1/3/0/3/130313400/25128ac033957b.pdf
    • http://noahopper.com/uploads/1/3/0/2/130287313/gamedofupilexa-simefoluki-nokimomokelaj-gozosefupavi.pdf
    • http://danyellscakesandcreations.com/uploads/1/3/0/5/130540926/genaduvodan.pdf
    • http://radiomusicsociety.com/uploads/1/3/0/6/130622025/2895511.pdf
    • http://queblesolutions.com/uploads/1/3/0/8/130813834/8493627.pdf
    • http://portugueshotelescumbreswb.devsite-1.com/uploads/1/3/0/8/130814043/130814043.html#differential+diagnosis+brachial+plexus+injury

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000511f.bin
cc2dc63fdacd8e30f2a9e94fc8117bdaad896be984ce33c37896a0392bf1eb25		 pdf-font-stream PDF embedded font (sfnt) at offset 0x511F 16096 bytes
font_01_sfnt_off000068d8.bin
68302fd35be92402464fe51620b952bcd302f47044b19f31095261928137b15c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x68D8 8552 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.