Malicious PDF — malware analysis report

Static analysis result for SHA-256 6175cb2ccd77d949…

MALICIOUS

PDF

34.0 KB Authoring application: SWFTools
MD5: 1822931e171d70472ef227d4eb51f0ee SHA-1: 84ff40958812dc9dd622b7a231a5f28b8b9e2a84 SHA-256: 6175cb2ccd77d9492ef997d517be3836cc37d3def696c93451ae64c95d4a41ea
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded links to external PDF files, a technique often used for SEO manipulation or to distribute further malicious content. The ClamAV detection and ML classifier strongly indicate malicious intent, classifying it as Pdf.Phishing.TtraffRobotInstall. While no scripts were explicitly extracted, the PDF structure and embedded URLs suggest a phishing or content distribution attack. The document body contains garbled text and references to 'Microsoft picture manager to pdf converter online', which may be a lure.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://insight2empower.biz/uploads/1/3/0/5/130588343/3791697.pdf
    • http://onepartrepubic.com/uploads/1/3/0/5/130590714/4bea5.pdf
    • http://lessononetwothree.com/uploads/1/3/0/6/130640178/57cfcbe.pdf
    • http://amfwpg.com/uploads/1/3/0/5/130590555/9734381.pdf
    • http://kreistyle.com/uploads/1/3/0/4/130476687/nasisa-tumaverapote.pdf
    • http://thecbdbeauty.shop/uploads/1/3/0/7/130738902/15cf8b7f80925.pdf
    • http://gigitgleesinenterprises.com/uploads/1/3/0/4/130483329/vuloxedovalag.pdf
    • http://intellidocs.net/uploads/1/3/0/2/130291415/9601513.pdf
    • http://nnoodl.com/uploads/1/3/0/7/130776007/4735fb.pdf
    • http://insultrocks.com/uploads/1/3/0/7/130738631/saberiku-gufekabivemab.pdf
    • http://mertior.com/uploads/1/3/0/7/130775002/4866f188a.pdf
    • http://iglesiamulticulturalwestside.com/uploads/1/3/0/3/130323571/maxime.pdf
    • http://agnesmusic.net/uploads/1/3/0/6/130620873/657951.pdf
    • http://csgocave.net/uploads/1/3/0/7/130775685/9529555.pdf
    • http://www.ncfashionexpotakeover.com/uploads/1/3/0/2/130289427/vubilafupigoxe-muxowari-bakezanulap.pdf
    • http://listborg.net/uploads/1/3/0/6/130605338/vatagopasut.pdf
    • http://nowphotobooths.com/uploads/1/3/0/4/130476060/doxotubojajeza-tasobijogis.pdf
    • http://westsideconstructiongroup.com/uploads/1/3/0/8/130813779/fuxakutipewixu-tokibeniwi-wubabuduziwuf.pdf
    • http://themusictheater.com/uploads/1/3/0/6/130639424/4901851.pdf
    • http://currentstates.com/uploads/1/3/0/3/130323106/jaxul.pdf
    • http://madeinvenice.net/uploads/1/3/0/6/130621683/nelubunojob.pdf
    • http://realmisterketo.com/uploads/1/3/0/5/130550953/ronesibu.pdf
    • http://eng-kayla-j.pleasingfood.com/uploads/1/3/0/2/130289227/130289227.html#microsoft+picture+manager+to+pdf+converter+online

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002679.bin
bbd630d44be8c7ce94f306e8f976ad09996c51eef76966586eb98410638e1c5d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2679 6736 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.