Malicious PDF — malware analysis report

Static analysis result for SHA-256 837c9cfba05bd891…

MALICIOUS

PDF

57.0 KB Authoring application: Serif PagePlus
MD5: a8f50b8e3c142a887fc87f1a64106ceb SHA-1: 8d8bed9e7332ba82847ba0b2084f9153f9043d4f SHA-256: 837c9cfba05bd89114fd8e3154a05427a1bc1b1d8a1e70ab1c0bb1afec25d280
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file contains a large number of embedded links, identified by the PDF_SEO_LINK_FARM heuristic, which strongly suggests a phishing or malicious redirection attempt. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports this assessment. No scripts were extracted, but the presence of numerous external links indicates an attempt to lead the user to malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://epaprofessionalhome.com/uploads/1/3/0/8/130813967/tupasaxuxexuni_xarijilexuxaj_pikuv_ninegebobex.pdf
    • http://organik-zeytinyaglari.com/uploads/1/3/0/7/130775705/bifaxub-febom.pdf
    • http://engagemediacorporation.com/uploads/1/3/0/7/130776027/7458954.pdf
    • http://welcometokhaos.com/uploads/1/3/0/4/130476010/ferolurukot.pdf
    • http://nevadarapidcash.com/uploads/1/3/0/8/130874470/jififepa-mawoveselov.pdf
    • http://cleanestwindowscolorado.com/uploads/1/3/0/2/130272516/fonemox_wixoxute_bikusixodorag.pdf
    • http://kctrudgill.com/uploads/1/3/0/7/130739945/mametizex_lewuzuxo.pdf
    • http://wyld3.com/uploads/1/3/0/5/130551324/8998601.pdf
    • http://y-iptv.net/uploads/1/3/0/7/130776343/zibomuzovive.pdf
    • http://www.artistshae.com/uploads/1/3/0/7/130776720/milavelutod.pdf
    • http://rscrystalmedicine.com/uploads/1/3/0/2/130270903/sivisuzivedikoliti.pdf
    • http://meowstories.us/uploads/1/3/0/6/130604200/6910f9104155c.pdf
    • http://www.clevelandjuicebox.com/uploads/1/3/0/5/130588772/c6ec93.pdf
    • http://upcom.us/uploads/1/3/0/6/130620826/130620826.html#botw+map+of+all+shrines

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000134a.bin
51d3a0217dcd3bfdab0c909b6283a05ddb0b9c9acd59009bc44901198a59803b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x134A 8232 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.