Malicious PDF — malware analysis report

Static analysis result for SHA-256 6ceb2f35983a6d51…

MALICIOUS

PDF

56.2 KB Authoring application: Solid Converter PDF First seen: 2020-12-25
MD5: dc19c419bb6d2cf0366167e36b0c4122 SHA-1: 56413aed78c6323213f5f31945dd82da3a121543 SHA-256: 6ceb2f35983a6d51453cea5c8b7841eba5d66aaf7c4c1bce9abe1e7be1720048
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of embedded links to external PDF files, a technique often used for SEO manipulation or to distribute further malicious content. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the ML classifier output strongly indicate malicious intent. No scripts were extracted, but the sheer volume of external links suggests a coordinated effort to redirect users to potentially harmful sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9987

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://mrsboucher.com/uploads/1/3/0/5/130551856/9cdcef.pdf In PDF document text
    • http://alexanderhaledesign.com/uploads/1/3/0/5/130539795/5a37d39c1c.pdfIn PDF document text
    • http://hostmaster.sugartrampoline.co.uk/uploads/1/3/0/5/130588435/faxujo.pdfIn PDF document text
    • http://hostmaster.bydenfarm.com/uploads/1/3/0/2/130287813/giwiramizejojoledag.pdfIn PDF document text
    • http://nonprofitconsultantsnetwork.net/uploads/1/3/0/2/130272070/wezosotuke.pdfIn PDF document text
    • http://utahbirthpros.com/uploads/1/3/0/7/130739363/siwat.pdfIn PDF document text
    • http://myaffiliatepages.org/uploads/1/3/0/6/130639960/tozosukud_bulovik.pdfIn PDF document text
    • http://ohiomsc.com/uploads/1/3/0/7/130775544/tejujopawotejutuko.pdfIn PDF document text
    • http://delfinocarrasco.com/uploads/1/3/0/6/130605040/eed3b1a38.pdfIn PDF document text
    • http://www.thecaribbeanrocks.com/uploads/1/3/0/5/130551491/sujiwixafani_lunuguderosen_kasifurulo_xawixira.pdfIn PDF document text
    • http://pomjc2.bdgct.com/uploads/1/3/0/4/130435998/130435998.html#devanagari+hindi+typing+onlineIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://fedorahosted.org/lohitIn PDF document text
    • https://fedoraproject.org/wiki/Licensing/LiberationFontLicenseIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
    • https://savannah.gnu.org/projects/freefont/In PDF document text
    • http://www.gnu.org/licenses/In PDF document text
    • http://www.gnu.org/copyleft/gpl.htmlIn PDF document text

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003613.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3613 2652 bytes
SHA-256: e2f1373bf3d70a40ff4276a486f0a1d2d32154e4f45ad1243a44c3d3b7d91cea
font_01_sfnt_off00003ee9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3EE9 1388 bytes
SHA-256: 1723f1ced37cc89d69e30f3df6281c5e5fb8989544fd4587aa75b00c91af2fd0
font_02_sfnt_off000045ef.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x45EF 16132 bytes
SHA-256: 50b13560b5d9de2857f15ecc2c21d95bc38e0e5469d151a043fb7a8a9363e662
font_03_sfnt_off00005cb1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5CB1 13500 bytes
SHA-256: d1c66da09e8d8188f62755be14ff47598047f92f8fcdaf11bf4842a0ab5ede04
font_04_sfnt_off0000836d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x836D 9160 bytes
SHA-256: b822ba78636735b9bd9cb1f07b32ff70807a25d7e4f2f7f3abe55c5055275fb6

Open this report in the interactive analyzer, or submit your own file for analysis.