Malicious PDF — malware analysis report

Static analysis result for SHA-256 6e9a81fbbc67bea6…

MALICIOUS

PDF

42.4 KB Authoring application: Adobe PDF Library 9.0
MD5: b4c98a488b51186cb60add7c98a98a54 SHA-1: 3e0f1f1d61d1fc130a2067752f3f61df8c96757c SHA-256: 6e9a81fbbc67bea68861e0d549f0925ce9d77ab043f8e0fe03d64bc47f9a1de7
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded URLs pointing to external PDF files, a technique often used for SEO manipulation or to distribute further malicious content. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the ML classifier output strongly indicate malicious intent. While no scripts were explicitly extracted, the nature of the embedded URLs suggests a potential for JavaScript execution to facilitate redirection or payload delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ppc-rainmaker.com/uploads/1/3/0/8/130814225/846658.pdf
    • http://constructiondiaries.net/uploads/1/3/0/7/130739993/juxojubufunof_wulep_nifojabupupowis_rakaxi.pdf
    • http://motherlodemontessori.org/uploads/1/3/0/6/130621108/ronusutosavix.pdf
    • http://negsbestthing.com/uploads/1/3/0/5/130590310/mukobimiresunum.pdf
    • http://pinotnoiro.com/uploads/1/3/0/8/130813782/wikawinedopujipe.pdf
    • http://myoptique2020.com/uploads/1/3/0/5/130544321/ca7a5a02.pdf
    • http://backonyourfeetmassage.com/uploads/1/3/0/2/130270996/119829.pdf
    • http://www.travelandmysteryblog.com/uploads/1/3/0/5/130550879/5095294.pdf
    • http://www.iamworthhim.com/uploads/1/3/0/6/130620168/768989.pdf
    • http://dreamcatalyst.org/uploads/1/3/0/5/130543552/62971a583c109f.pdf
    • http://lowande.com/uploads/1/3/0/8/130813548/karibevime.pdf
    • http://kepishopee.online/uploads/1/3/0/6/130604862/0f1d0a5.pdf
    • http://chiccityhippieheartproductions.com/uploads/1/3/0/6/130605355/9421998.pdf
    • http://www.holytrinitybalaclava.com.au/uploads/1/3/0/7/130776485/fopibabosepa-kajitodiran-kerivexe-gojes.pdf
    • http://vermatesa.com/uploads/1/3/0/5/130590482/1712613.pdf
    • http://daletnyc.com/uploads/1/3/0/6/130639575/ae619cd317.pdf
    • http://reliantpayrollandbookkeeping.com/uploads/1/3/0/7/130775961/tuwodemamise.pdf
    • http://dattebayo.net/uploads/1/3/0/5/130543264/somiv.pdf
    • http://columbusliceremoval.com/uploads/1/3/0/7/130775277/9155990.pdf
    • http://merlotgroup.com/uploads/1/3/0/5/130546283/notake.pdf
    • http://properplace.info/uploads/1/3/0/8/130813466/2702100.pdf
    • http://befunctionaltenerife.com/uploads/1/3/0/3/130324288/b9419f87d.pdf
    • http://craigheadcounty4hrabbitclub.com/uploads/1/3/0/4/130476525/2200627.pdf
    • http://aammf.bpmtc.com/uploads/1/3/0/9/130969465/130969465.html#ayyappa+ringtones+telugu+2018+download
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002ab8.bin
bb65e153df78154bfd14470754e87ba03df7715f8d52849d071c5334056f3476		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2AB8 16096 bytes
font_01_sfnt_off0000425d.bin
cd5d91d9de377bb0b1a6cd1e435d69c0789ab7f63fd8a07b04b6d81a10dc96ee		 pdf-font-stream PDF embedded font (sfnt) at offset 0x425D 9172 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.