Malicious PDF — malware analysis report

Static analysis result for SHA-256 8146bae1186e3835…

MALICIOUS

PDF

42.8 KB Authoring application: PDFBox
MD5: e092d08032d50e3cfc26a7085b922d5b SHA-1: 22056372483b7cc9ac28ef0ee9d1872c9d4926eb SHA-256: 8146bae1186e38353556aacc89ea47768d428a89737389121f643bf55b7974f7
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a large number of embedded links, identified by the PDF_SEO_LINK_FARM heuristic, which are likely intended to redirect users to malicious sites. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the ML classifier's high confidence score further support its malicious nature. The document body mentions 'Soundcloud er pro ios' and hints at payment cancellation, suggesting a phishing lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://horsetemplates.com/uploads/1/3/0/7/130775958/fc9d7e.pdf
    • http://moxiemerchdesign.com/uploads/1/3/0/5/130589090/59557ad5c0d73.pdf
    • http://banjolele.net/uploads/1/3/0/6/130605074/7726331.pdf
    • http://nomadiccollege.com/uploads/1/3/0/7/130738499/fafowopuniz_tapunak.pdf
    • https://zinitowamatip.weebly.com/uploads/1/3/0/5/130539738/susupupa_wowisuxop_kuvokarotar_batatu.pdf
    • http://youthbuildillinois.org/uploads/1/3/0/6/130621575/gafodeko_xozomebejuf_kutikufa.pdf
    • http://cityonloc.com/uploads/1/3/0/6/130604248/130604248.html#soundcloud+er+pro+ios

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001150.bin
fc9b228a2682331dffd572df3c1b7a7e40b0ae4bafefa9f64be01eccf8388be8		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1150 8876 bytes
font_01_sfnt_off00006d70.bin
3cf2e61d6a9a17d67058092f735344da68aafd773256a5c2a16702179a7e0181		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6D70 1764 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.