Malicious PDF — malware analysis report

Static analysis result for SHA-256 74b52e5a7cec578c…

MALICIOUS

PDF

37.7 KB Authoring application: ImageMagick
MD5: 018a94e93a3a1324a6bb197e9ba57405 SHA-1: baa113e889112e9fcfe7f14145161e0ab1807a57 SHA-256: 74b52e5a7cec578c599b75628e2620ce91f215f2ac3300acc92fe4fa7cb9aa19
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded external links, as detected by the PDF_SEO_LINK_FARM heuristic. The ML classifier and ClamAV also flagged this file as malicious, with ClamAV identifying it as Pdf.Phishing.TtraffRobotInstall-7605656-0. The primary attack pattern involves directing users to a multitude of PDF files hosted on various domains, suggesting a link farm or distribution mechanism for malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://9thwonderco.com/uploads/1/3/0/5/130550703/tusepibasij_xopitosixil.pdf
    • http://ilcic.org/uploads/1/3/0/6/130605448/bezefil.pdf
    • http://nationalarchivesphotographer.com/uploads/1/3/0/5/130550882/xuwejiwa.pdf
    • http://wehrtvets.org/uploads/1/3/0/6/130604519/76ddce.pdf
    • http://gtacounselling.ca/uploads/1/3/0/7/130776423/34bb51a252.pdf
    • http://akart.ee/uploads/1/3/0/8/130813649/4df1ae2444.pdf
    • http://mooculture.com/uploads/1/3/0/5/130589144/3632481.pdf
    • http://www.hospiceofcharlotte.com/uploads/1/3/0/9/130969216/e4226f623346fc.pdf
    • http://next2younext2me.net/uploads/1/3/0/5/130543006/fubokezej.pdf
    • http://suicidepreventionproject.com/uploads/1/3/0/3/130323120/352064a4903.pdf
    • http://thehappylifeacademy.com/uploads/1/3/0/7/130776113/didajapinegunop.pdf
    • http://www.cakesbysal.com.au/uploads/1/3/0/6/130621954/6f5482344.pdf
    • http://aothsmusic.com/uploads/1/3/0/6/130640024/5254689.pdf
    • http://joshuachi.net/uploads/1/3/0/3/130323229/1291a6d35d1.pdf
    • http://davidkcampaign.org/uploads/1/3/0/7/130740116/neretagitomirob.pdf
    • http://financialcleansing.com/uploads/1/3/0/6/130639315/futopagirimagu_tetolal_ranezanuxesowa_repotarap.pdf
    • http://22ndcenturysolutions.com/uploads/1/3/0/7/130775593/8b5f6bb7b.pdf
    • http://unitedinfood.com/uploads/1/3/0/3/130379151/xerinebumunifo.pdf
    • http://www.midcenturymodernmazeart.com/uploads/1/3/0/4/130476516/4063382.pdf
    • http://hiddengemsenterprise.com/uploads/1/3/0/5/130589386/2496906.pdf
    • http://oceanateyelevel.com/uploads/1/3/0/3/130313235/9247713.pdf
    • http://pawsacrosstheborder.net/uploads/1/3/0/2/130271255/6303827.pdf
    • http://riccartondental.co.uk/uploads/1/3/0/6/130621874/2353199.pdf
    • http://chopstir.com/uploads/1/3/0/2/130272600/lipudigemu-wujajawu-xubiwasuxojifo-vewogewax.pdf
    • http://noontide79.pleasingfood.com/uploads/1/3/0/7/130775339/130775339.html#strength+and+weakness+of+maslow+motivation+theory

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000031a7.bin
3f302a4e831e762c0d313eaf3228303d9d2ba21a983177ea6e7b844edd3fc1ad		 pdf-font-stream PDF embedded font (sfnt) at offset 0x31A7 7248 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.