Malicious PDF — malware analysis report

Static analysis result for SHA-256 656c05227407ca58…

MALICIOUS

PDF

44.9 KB Authoring application: PDF Studio
MD5: 16a49f426d199974721d019a20bfeece SHA-1: 6f5a9bc18404311eb9104aad8bd207254bc8c965 SHA-256: 656c05227407ca58201649ddb8aed48adc9d2bf5a7822b8163942aac107b96f8
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF document was flagged by multiple heuristics, including a critical ClamAV detection for 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and a PDF link farm detection. The document contains a mass of external PDF links pointing to various domains, suggesting a phishing or SEO-based distribution scheme. No scripts were extracted, but the embedded URLs are the primary indicators of malicious activity.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ashleyblaire.com/uploads/1/3/0/5/130590698/2087c0f43.pdf
    • http://www.shinebrightgrillz.com/uploads/1/3/0/6/130604765/8826130.pdf
    • http://meredithmorrisisawesome.com/uploads/1/3/0/6/130621307/raxatuzonufilam.pdf
    • http://www.epm3ltd.com/uploads/1/3/0/9/130969614/8036705.pdf
    • http://myleegen.com/uploads/1/3/0/6/130620528/jazoxi-zeginur.pdf
    • http://composerfirst.com/uploads/1/3/0/7/130776074/7119274.pdf
    • http://vegandoctor.org/uploads/1/3/0/6/130622025/1044ab14f5.pdf
    • http://michelleislivingwell.com/uploads/1/3/0/3/130323154/tugarug-vumobixugesavi-dowune.pdf
    • http://datinglovers.nl/uploads/1/3/0/7/130739651/tevorogo_ramutu_boxinovomofidu.pdf
    • http://jaguartracks.com/uploads/1/3/0/6/130640116/leponitamenubudamo.pdf
    • http://crystalcatdesigns.com/uploads/1/3/0/7/130776804/kabodeteramolaxe.pdf
    • http://www.booksbyme.co.uk/uploads/1/3/0/6/130603836/mifafesomufej_jumikax.pdf
    • http://funktionaalinenravitsemus.fi/uploads/1/3/0/6/130621909/tolebatimuku_mesamizawowapij.pdf
    • http://advantageonellc.com/uploads/1/3/0/6/130640208/abcf44940ebd.pdf
    • http://ceramicleaguemiami.com/uploads/1/3/0/4/130483412/nalam_kolezobexomuw.pdf
    • http://blau-logistics.com/uploads/1/3/0/3/130323672/4219648.pdf
    • http://atozadventures.co.uk/uploads/1/3/0/6/130622022/lujikejafo.pdf
    • http://www.cpanel.razorshotradiokhhr.com/uploads/1/3/0/6/130603918/mutalometum.pdf
    • http://www.midses3.com/uploads/1/3/0/7/130775780/lopeja.pdf
    • http://o0378.bpmtc.com/uploads/1/3/0/5/130544652/47e9c0b3c1495.pdf
    • http://goodnewsdailydiner.com/uploads/1/3/0/6/130605279/disigorunakaxid-xavek.pdf
    • http://4osterie.com/uploads/1/3/0/3/130323738/bdec44c0250266.pdf
    • http://74-123-77-77.mgwnet.com/uploads/1/3/0/7/130775939/130775939.html#roche+clinical+trials+database

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004f7d.bin
9e9e6fd0760712d469ad3eba215c262582fdab4db52b2305228621147833a124		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4F7D 7520 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.