Malicious PDF — malware analysis report

Static analysis result for SHA-256 76f25e6d0c3df320…

MALICIOUS

PDF

36.2 KB Authoring application: Serif PagePlus
MD5: 5d6d9cf46e6d4c45f6e9a985a284659d SHA-1: 7167dee0c3e98b196f9127172a003e221116a755 SHA-256: 76f25e6d0c3df320e9f5b7c513ec1c62b8e4b915aca6c2fa567dc57a7698d3f0
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file contains a mass external link farm, with multiple URLs pointing to other PDF files. The document body, though heavily corrupted, appears to be a lure related to an 'Airasia mobile boarding pass'. The heuristic 'PDF_SEO_LINK_FARM' and ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' strongly indicate a phishing or malicious redirection attempt. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://amyhelps.com/uploads/1/3/0/7/130775593/zelasosidobubunis.pdf
    • http://wellfleetpirate.com/uploads/1/3/0/5/130539225/9007290.pdf
    • http://neosal.com/uploads/1/3/0/7/130738716/8efe8e08bd18953.pdf
    • http://www.stoneslifecoaching.com/uploads/1/3/0/8/130813649/6189791.pdf
    • http://bereavementbubbles.com/uploads/1/3/0/5/130543045/kimipapiga.pdf
    • http://petrocartaenergy.com/uploads/1/3/0/6/130604687/3542737.pdf
    • http://obituar.org/uploads/1/3/0/7/130739964/risubipumokisaj_zatis_deduwisofe.pdf
    • http://mybabyluvz.com/uploads/1/3/0/4/130435881/firugileliv_wojoxet_bumib.pdf
    • http://spartanadvantage.com/uploads/1/3/0/4/130435682/nawobe.pdf
    • http://mindforyou.org/uploads/1/3/0/7/130739185/1216336.pdf
    • http://a6h.com/uploads/1/3/0/5/130544754/zibozap.pdf
    • http://sandymullinsonline.com/uploads/1/3/0/6/130621373/6956063.pdf
    • http://autodiscover.storgebhs.com/uploads/1/3/0/6/130621371/130621371.html#airasia+mobile+boarding+pass

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000026f2.bin
83459e82cebe561b9e65dda6a09953c9e35f75e5df0fa62a624e1833cc5b8086		 pdf-font-stream PDF embedded font (sfnt) at offset 0x26F2 1708 bytes
font_01_sfnt_off0000325e.bin
2affc65744ea9b8fbf63c626d7e00a8914d43aee310efccb8d86203bef7d6d96		 pdf-font-stream PDF embedded font (sfnt) at offset 0x325E 8880 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.