Malicious PDF — malware analysis report

Static analysis result for SHA-256 6247db2aa020f083…

MALICIOUS

PDF

54.6 KB Authoring application: PDF Studio
MD5: 55503ca8118b8da09e7fd404772fbcff SHA-1: acdd9c487b06b84f41dbeab2993008de8dc4ca38 SHA-256: 6247db2aa020f08396e0b8907e0e25ea2860d1eb580586bbeb271b40d075861d
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. The ClamAV detection and ML classifier also indicate maliciousness, with ClamAV specifically identifying it as 'Pdf.Phishing.TtraffRobotInstall'. The embedded URLs likely serve as a lure to phishing sites or to download further malicious payloads.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://montanabridalshows.com/uploads/1/3/0/7/130739928/rolumovunuwina.pdf
    • http://siobhanartandecology.com/uploads/1/3/0/6/130639973/5394469.pdf
    • http://strangenamedoc.com/uploads/1/3/0/5/130588315/wubomomofipevi.pdf
    • http://vigrinhotels.com/uploads/1/3/0/6/130621425/2293978.pdf
    • http://wellwellcreative.com/uploads/1/3/0/5/130540366/safesekejiri.pdf
    • http://nw1.me/uploads/1/3/0/4/130488574/0befe7708258ff.pdf
    • http://www.britishmountainacademy.com/uploads/1/3/0/5/130544147/74df1c11f5e54d.pdf
    • http://baymediaproductions.com/uploads/1/3/0/8/130874162/tobobixerapigibulaz.pdf
    • http://paymeprompt.net/uploads/1/3/0/6/130603793/xedagogedu.pdf
    • http://mikaren.com/uploads/1/3/0/5/130588718/dotusefe.pdf
    • http://eldersemporium.com/uploads/1/3/0/2/130274301/vifab.pdf
    • http://ichunes.com/uploads/1/3/0/7/130776609/cdeaf40e.pdf
    • http://333survival.com/uploads/1/3/0/4/130476778/ranuzeraren.pdf
    • http://adancerstouch.com/uploads/1/3/0/7/130739505/zepubezu.pdf
    • http://www.vote-for-our-schools.com/uploads/1/3/0/6/130620689/3755428.pdf
    • http://buildsolutionz.com/uploads/1/3/0/6/130603861/2586f57e.pdf
    • http://bygollycandlesnmore.com/uploads/1/3/0/5/130551331/luzexikusojagabonuno.pdf
    • http://sassyscraps.com.au/uploads/1/3/0/2/130271111/dolupilinateba.pdf
    • http://empire23.com/uploads/1/3/0/8/130813972/juner.pdf
    • http://core-transformation.org/uploads/1/3/0/4/130483809/ec6a425a4f.pdf
    • http://theharrishawkinshometeam.com/uploads/1/3/0/7/130739500/5277940.pdf
    • http://amjvy.slpny.com/uploads/1/3/0/7/130739322/130739322.html#rubrik+penilaian+akreditasi+paud+pdf

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002ee4.bin
fef7818fab1d4ddc7b3dfabbd5cf9cdef6a518f20e81bfb9805eccb9ae9d1831		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2EE4 7396 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.