Malicious PDF — malware analysis report

Static analysis result for SHA-256 82e222ba72b650b4…

MALICIOUS

PDF

34.9 KB Authoring application: PDFedit
MD5: f5a18184e0068f3383420a0c7963c85e SHA-1: a57189f1381d5ea15b651850a90fa0efc0f0a717 SHA-256: 82e222ba72b650b45282f47cd248d49d46ece06a5e7314146682963a928e6cf8
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded URLs pointing to other PDF files, indicating a link farm designed to distribute malicious content. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the ML classifier strongly suggest a phishing or malware distribution campaign. The embedded URLs are the primary IOCs, facilitating the attack by redirecting users to potentially harmful content.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://northweststeamart-uk.com/uploads/1/3/0/6/130604145/tezopoduxololetax.pdf
    • http://mail.music4you.nl/uploads/1/3/0/5/130550903/xupakuve.pdf
    • http://trentriverdesigns.com/uploads/1/3/0/7/130739239/tigefujijoj-kilevoge-bavofar.pdf
    • http://sewmazingquilting.com/uploads/1/3/0/4/130436068/4190560.pdf
    • http://www.armycorpenterprises.com/uploads/1/3/0/5/130541064/3765231.pdf
    • http://techsuny.com/uploads/1/3/0/6/130605229/xulubomagaweli.pdf
    • http://bluffcreekfarmsbedandbreakfast.com/uploads/1/3/0/4/130489830/810a9a3.pdf
    • http://mrncrdbl.com/uploads/1/3/0/7/130740389/025222dce625051.pdf
    • http://mysteryshoppingonlinejob.com/uploads/1/3/0/6/130640225/ee83e994e03.pdf
    • http://camporiondo.com/uploads/1/3/0/7/130739020/vebesi.pdf
    • http://lendamico.me/uploads/1/3/0/5/130551488/wasow-posezoxebej-laxeku-xixeripazuturum.pdf
    • http://alyssaperryinteriors.com/uploads/1/3/0/2/130272240/wavut.pdf
    • http://kohno-corp.com/uploads/1/3/0/3/130313378/130313378.html#blender+texture+atlas

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002ee1.bin
48015342a494982231af3f93459d6ca0743a5a71d51cd9afd0aa1e1ebc02d64b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2EE1 8436 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.