Malicious PDF — malware analysis report

Static analysis result for SHA-256 7cb8fe947e5b80b9…

MALICIOUS

PDF

42.0 KB Authoring application: pdf-parser
MD5: c41e9dcad304df8544dc6da8c33ce49a SHA-1: 37aa0ff0960a71a2c30aa8d90162d50518a7f908 SHA-256: 7cb8fe947e5b80b93363634c0d81d0b2b3ad7cee8f60defb6564239af3a55a6c
160 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links to external PDFs, indicating a link farm designed to distribute malicious content. ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and ML classification further support its malicious nature. The presence of a visual download button lure reinforces the phishing attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://alysebonline.com/uploads/1/3/0/6/130639083/kusuf_kufodotolilotun_pekupimemajas_duwozi.pdf
    • http://alohabrewed.com/uploads/1/3/0/6/130620340/nuxuvakema.pdf
    • http://catapultconsultants.com/uploads/1/3/0/5/130542727/1bb0e88937.pdf
    • http://ivjournal.com/uploads/1/3/0/7/130739878/vuwubix.pdf
    • http://bestbroadbandsupplier2019.co.uk/uploads/1/3/0/6/130639115/garapevixalovo.pdf
    • http://dragonflyphotographyceramics.com/uploads/1/3/0/5/130551456/zopoxutafutalo.pdf
    • http://mrglows.com/uploads/1/3/0/6/130640141/3e697a95a.pdf
    • http://mikemcman.com/uploads/1/3/0/4/130489123/poxufutatet.pdf
    • http://kelseyhopebrewer.com/uploads/1/3/0/5/130550847/2929694.pdf
    • http://chefbasils.com/uploads/1/3/0/5/130590235/jipediteraduxaxod.pdf
    • http://deniseramsden.ca/uploads/1/3/0/5/130590507/jodazuxevisulip.pdf
    • http://thepoopbucket.com/uploads/1/3/0/5/130590509/pomep.pdf
    • http://lucasroy.net/uploads/1/3/0/7/130739621/mezukimo.pdf
    • http://mindfulheartprograms.com/uploads/1/3/0/6/130604054/wepuruxijane.pdf
    • http://soccer.peakathleticsystems.com/uploads/1/3/0/2/130273790/130273790.html#ielts+speaking+cue+card+topics+2018+with+answers
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003227.bin
1d1fa5121415f8f5353993473374918b9d2a38f433752094af4cce5d3be72c8c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3227 16312 bytes
font_01_sfnt_off00004a8d.bin
f1e9fa50ba506c3c41c91a5696063f4349d7fa66468609664818999124ad163a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4A8D 7868 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.