Malicious PDF — malware analysis report

Static analysis result for SHA-256 5a9227d43e9fd19d…

MALICIOUS

PDF

35.9 KB Authoring application: Poppler-utils
MD5: 9be20920e81aa81d979bd73c769a551f SHA-1: 3cd8bbb80d10ea7222d142f787159e05ce6e0527 SHA-256: 5a9227d43e9fd19da2e9889b4668bf3adb74ee4861b49f80ce9ae523ced7e48f
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF contains a large number of embedded external links to other PDF files hosted on various domains. This behavior is indicative of a link farm or a distribution mechanism for further malicious content. ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the ML classifier's high confidence score further support the malicious nature of this file. The document body's content is heavily obfuscated and does not provide clear instructions.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://lifetrackfinancialadvisors.com/uploads/1/3/0/7/130739628/4fcd18361fef.pdf
    • http://ivyandfluff.com/uploads/1/3/0/7/130739396/rajafupule_pupugil.pdf
    • http://theballroommarketplace.com/uploads/1/3/0/6/130605440/1325241.pdf
    • http://salsaupanishads.com/uploads/1/3/0/7/130740537/3763405.pdf
    • http://parentingo.com/uploads/1/3/0/4/130489358/9215dd1ba.pdf
    • http://espace-fortueno.net/uploads/1/3/0/5/130589085/9369388.pdf
    • http://shanaspaw.com/uploads/1/3/0/7/130775682/mukoresukakuno.pdf
    • http://like-pi.net/uploads/1/3/0/4/130477890/7665436.pdf
    • http://toponsitewellness.com/uploads/1/3/0/6/130603688/5943274.pdf
    • http://openarmsbanduk.com/uploads/1/3/0/7/130738996/2e5f0d7ae33c8d6.pdf
    • http://www.onlinefitnessunderground.com/uploads/1/3/0/6/130639099/wapira.pdf
    • http://adabookkeepingservices.com/uploads/1/3/0/6/130603682/b32090c8.pdf
    • http://shoreditchmama.co.uk/uploads/1/3/0/7/130738753/divuregozigi.pdf
    • http://oceanviewchristian.com/uploads/1/3/0/6/130621916/6525f8d.pdf
    • http://vps27.pleasingfood.com/uploads/1/3/0/7/130776646/130776646.html#research+report+writing+steps+pdf

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003206.bin
9baabf66897376140a67d017e9ee79338f50af4b80221e6fb6ea6b386ba5bdb0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3206 8204 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.