Malicious PDF — malware analysis report

Static analysis result for SHA-256 638f156e8b0773a0…

MALICIOUS

PDF

38.3 KB Authoring application: Poppler-utils
MD5: a900380d70d6d59457ae8e171d4071d6 SHA-1: 51f51b9b0e4601fd52c220596e960b3f4e80e227 SHA-256: 638f156e8b0773a0429ed9cc699712fafc85cb8e709dc0b0085781e8cf359d54
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded URLs pointing to other PDF files on various domains, a technique often used for SEO spam or to distribute further malicious content. ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and ML classification strongly indicate malicious intent. The embedded URLs are likely part of a link farm designed to redirect users or search engines.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://northporthomesofhuron.net/uploads/1/3/0/6/130639398/jalirapoge.pdf
    • http://redoxamazingmolecules.com/uploads/1/3/0/6/130621115/39de20f5f89.pdf
    • http://afuture-ahope.com/uploads/1/3/0/7/130775744/vuxozuderawojorejuse.pdf
    • http://nwsconstruction.info/uploads/1/3/0/8/130874599/cafe278b3.pdf
    • http://thedailyclosure.com/uploads/1/3/0/2/130289480/af79989d027b3e0.pdf
    • http://belliesandbundle.com/uploads/1/3/0/6/130639092/tasut.pdf
    • http://abodonnellfitness.com/uploads/1/3/0/3/130313624/sepatebiwo.pdf
    • http://morstargar.com/uploads/1/3/0/2/130289581/c61ee6990.pdf
    • http://chasingnormal.org/uploads/1/3/0/5/130547340/timijubugeg.pdf
    • http://oregonhomesandranch.com/uploads/1/3/0/5/130543472/8668243.pdf
    • http://adenexpress.com/uploads/1/3/0/7/130739910/1759925.pdf
    • http://movingmemorycompany.com/uploads/1/3/0/5/130542781/1208695.pdf
    • http://med-impulse.ru/uploads/1/3/0/5/130588834/xudijuvoro.pdf
    • http://www.artbystein.com/uploads/1/3/0/5/130545365/1410731.pdf
    • http://3mtruedefinitionlab.com/uploads/1/3/0/7/130776367/sufojada_lasok_zuvuwozixo.pdf
    • http://spinzoom.com/uploads/1/3/0/6/130604014/2878190.pdf
    • http://totahr.com/uploads/1/3/0/5/130590435/8067489.pdf
    • http://cltepicentre.com/uploads/1/3/0/4/130483114/53aef3.pdf
    • http://c0171196xstreamtravel.xsideas.com/uploads/1/3/0/6/130604285/130604285.html#dicot+and+monocot+stem+anatomy

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003a17.bin
98a94af9e3943cfc1419837e0a7aa2d56ec76fbd624c503590729ecf68bcafc2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3A17 7368 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.