Malicious PDF — malware analysis report

Static analysis result for SHA-256 55d5f207954782e4…

MALICIOUS

PDF

41.4 KB Authoring application: Adobe PDF Library 9.0
MD5: 1fdb4a0bb397e3145dc3246ba919511a SHA-1: 4db1881b0e51e858c96df05db2513f39c10a7b2a SHA-256: 55d5f207954782e49cc19f29b66091cf0460e49bac94ab690eb8d1a52bd52f71
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded links to external PDF documents, a technique often used for SEO manipulation or to distribute further malicious content. The ClamAV detection and ML classifier strongly indicate malicious intent. The embedded URLs are the primary IOCs, suggesting a link farm or redirection strategy.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ahahnart.com/uploads/1/3/0/6/130639678/9580722.pdf
    • http://fotographyhub.com/uploads/1/3/0/6/130605094/2299750.pdf
    • http://micromulsion.com/uploads/1/3/0/4/130488304/tixaga.pdf
    • http://mail.cynthiahovdaphotography.com/uploads/1/3/0/9/130969298/sivodidurovidemunif.pdf
    • http://bcyoungdems.org/uploads/1/3/0/9/130969284/2843548.pdf
    • http://www.rekindleclothing.com/uploads/1/3/0/8/130813756/7162493.pdf
    • http://sacramentoprocessserveronline.com/uploads/1/3/0/6/130621905/4187e983.pdf
    • http://oasescentre.com/uploads/1/3/0/7/130739746/8890315.pdf
    • http://www.garyloudermilk.com/uploads/1/3/0/5/130539718/3445376.pdf
    • http://timception.com/uploads/1/3/0/7/130775775/kuxopufisa.pdf
    • http://navixengineering.net/uploads/1/3/0/8/130874567/mobiwoxow.pdf
    • http://peterlofgrenarchitect.com/uploads/1/3/0/4/130483146/tugakokamidej.pdf
    • http://www.imrosiepatey.com/uploads/1/3/0/7/130740191/3008bb205603.pdf
    • http://www.brownpagebhc.com/uploads/1/3/0/8/130813821/somutapimowejifud.pdf
    • http://stavrias.com/uploads/1/3/0/7/130776525/soxemope-revodedugozaj.pdf
    • http://christidelnagro.com/uploads/1/3/0/4/130491513/rabonowavagolupoz.pdf
    • http://sunsetsailkeywest.net/uploads/1/3/0/8/130814143/dukizoru.pdf
    • http://michiganlegalmalpracticequestions.com/uploads/1/3/0/7/130775195/572f57.pdf
    • http://newmarkethanaiohana.com/uploads/1/3/0/3/130313027/1024625.pdf
    • http://apacint.com.au/uploads/1/3/0/6/130603841/2ac6f7a04.pdf
    • http://mta-sts.jeremycrutchley.com/uploads/1/3/0/2/130288551/9ba3b7.pdf
    • http://naturalchildbirthhelena.com/uploads/1/3/0/6/130639966/3615520.pdf
    • http://test.ladse.org/uploads/1/3/0/4/130476709/130476709.html#radial+basis+function+neural+network+matlab

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000041ae.bin
547b7b55a21284a7fb680f40e46752ce024131a679111578a39dba0528a77a60		 pdf-font-stream PDF embedded font (sfnt) at offset 0x41AE 7616 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.