Malicious PDF — malware analysis report

Static analysis result for SHA-256 6ace61d13c8b3270…

MALICIOUS

PDF

34.7 KB Authoring application: pdf-parser
MD5: 046bbd1fe34823eb65625f077a52491d SHA-1: e41070baab4ff117922443a5aa723ed1edf21e93 SHA-256: 6ace61d13c8b327063c20fad7ab02ef3ff61c46ee5b222adc8df0899d4e06b47
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded URLs pointing to other PDF files, a technique often used for SEO manipulation or to distribute further malicious content. ClamAV detected this as 'Pdf.Phishing.TtraffRobotInstall-7605656-0', indicating a phishing or malicious redirection attempt. The ML classifier also strongly flagged this PDF as malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.waltswanderings.com/uploads/1/3/0/5/130542734/kebul-mamar-vewama-mowidiganara.pdf
    • http://landedmusic.com.au/uploads/1/3/0/4/130483052/8232605.pdf
    • http://mail.chrisbracebuilders.com/uploads/1/3/0/8/130814298/kerurazajofe-wekawizuwilamo-dazalakelej-tubuturavep.pdf
    • http://blacktentcreative.com/uploads/1/3/0/5/130543640/jikunito.pdf
    • http://bet365yulechengwangzhi.br3h.com/uploads/1/3/0/6/130604175/sotet-buzane-polevirijan.pdf
    • http://newtaiwankonus.com/uploads/1/3/0/5/130589297/gobudevoribok.pdf
    • http://cmifamily.com/uploads/1/3/0/6/130639412/2022369.pdf
    • http://www.whitemanwaking.com/uploads/1/3/0/6/130639284/8450765.pdf
    • http://superyachtcharterfleet.com/uploads/1/3/0/4/130435862/wepoguko.pdf
    • http://bkfencing.com.au/uploads/1/3/0/6/130639027/mazulekuv_vawoli.pdf
    • http://planitgreenhumboldt.org/uploads/1/3/0/7/130740371/b6902eb.pdf
    • http://ccf-ag.org/uploads/1/3/0/2/130270895/rutevokajiwevi.pdf
    • http://theaudiophileworkshop.com.au/uploads/1/3/0/7/130775491/134546bb34bd79.pdf
    • http://sherwoodparkpianolessons.com/uploads/1/3/0/6/130621191/fofalikupet.pdf
    • http://amberindiacatering.com/uploads/1/3/0/2/130287317/mukebul-vijuvilaxez-sutepitajuxif-jubagenupoki.pdf
    • http://www.zucksstamps.com/uploads/1/3/0/2/130274241/depewi-vobuf-meladabol-wozatabu.pdf
    • http://doyoustillloveme.net/uploads/1/3/0/6/130620660/6127074.pdf
    • http://tinyscrolls.com/uploads/1/3/0/8/130813497/1999548.pdf
    • http://electronicparking.org/uploads/1/3/0/7/130740419/20e81f97f6.pdf
    • http://bacintra.com/uploads/1/3/0/6/130604595/xivirabepaxavi-zalobotexugagos-kokibufuxawu-puwid.pdf
    • http://webdisk.danielvm.com/uploads/1/3/0/2/130288932/130288932.html#carolina+panthers+season+tickets+2018

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000283e.bin
b2b97a3cd8fc09a0179b6b7758060066d9140957ecdfa222a62cf78564bfc192		 pdf-font-stream PDF embedded font (sfnt) at offset 0x283E 7624 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.