Malicious PDF — malware analysis report

Static analysis result for SHA-256 792cf41e46717d9b…

MALICIOUS

PDF

56.4 KB Authoring application: PDFedit
MD5: b21e541036604c9dbc826a8eafbbc501 SHA-1: c4596bc25d9a187f82df0bb3ba69b4cef8451fef SHA-256: 792cf41e46717d9b4c8fb5eb71684ebfdc759a1958ab3b4bdacd19ada9029600
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded external links, identified as a 'PDF_SEO_LINK_FARM' heuristic. These links point to various PDF files hosted on different domains, suggesting a campaign to manipulate search engine results or distribute malicious content. The ML classifier and ClamAV detection further confirm the malicious nature of the file, with ClamAV identifying it as 'Pdf.Phishing.TtraffRobotInstall-7605656-0'. No scripts were extracted, but the sheer volume of outbound links is the primary indicator of malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.aquahunterscom.com/uploads/1/3/0/7/130775478/7bc29f6b.pdf
    • http://diagmal.eu/uploads/1/3/0/5/130589396/7476822.pdf
    • http://new.advicetotheplayers.org/uploads/1/3/0/3/130312965/koxoli_vozobejaki.pdf
    • http://ohdearsboutique.com/uploads/1/3/0/5/130551805/9fb360.pdf
    • http://ethosbeats.com/uploads/1/3/0/5/130588639/vekimakeroma_jinikosi.pdf
    • http://www.truthinspiritbysandy.com/uploads/1/3/0/8/130874416/motuvigig.pdf
    • http://1444harrison.com/uploads/1/3/0/6/130639939/09425c2530a7e0.pdf
    • http://ovbeyondtherainbow.org/uploads/1/3/0/8/130814873/6587139.pdf
    • http://www.hveheartlifestyle.com/uploads/1/3/0/2/130272856/ruluvinuvikam_fiziji.pdf
    • http://mta-sts.mail.sandyblaisdell.com/uploads/1/3/0/2/130288506/funupegafov.pdf
    • http://rqgenesis.co/uploads/1/3/0/2/130289480/8cf63dfb3fbc1f0.pdf
    • http://suekennedycelebrant.com/uploads/1/3/0/3/130379194/kojodazipoxawem-kevuvelelasu-kowukopet-kizudovolewoj.pdf
    • http://nelsonfirm.com/uploads/1/3/0/6/130621055/729076e524b709.pdf
    • http://nfstoryboard.com/uploads/1/3/0/4/130488067/3f15ddd7a8488f7.pdf
    • http://ctshakerfurniture.com/uploads/1/3/0/7/130739343/melugupafebofa_pugisobikiniwug_gavud_fekizopovel.pdf
    • http://laboratoriodemateriales.net/uploads/1/3/0/7/130738641/5706337.pdf
    • http://towriteforyou.com/uploads/1/3/0/3/130313170/vizoju.pdf
    • http://www.hummobile.co/uploads/1/3/0/4/130483565/8496188.pdf
    • http://5pointauto.com/uploads/1/3/0/6/130639545/662895.pdf
    • http://neurology-u-tokyo.com/uploads/1/3/0/6/130621909/71acac.pdf
    • http://thankheaven.com/uploads/1/3/0/4/130476322/fozotati.pdf
    • http://calkdr.net/uploads/1/3/0/2/130287281/wupafunusimakusa.pdf
    • http://www.lynnettewatson.com/uploads/1/3/0/5/130543168/130543168.html#affairs+cloud+current+affairs+july+2
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://fedoraproject.org/wiki/Licensing/LiberationFontLicense

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001157.bin
b093ce5ef1d5db3a6f6f3c6a73b1693144b545a2666eab275fbc1553a0d3bcd4
pdf-font-stream PDF embedded font (sfnt) at offset 0x1157 9092 bytes
font_01_sfnt_off00009325.bin
e8e9a771120ddc844b49d5030f21ea4a5c65a49c56b3921c8cd14080325ef1aa
pdf-font-stream PDF embedded font (sfnt) at offset 0x9325 2728 bytes