Malicious PDF — malware analysis report

Static analysis result for SHA-256 84234e58b8991476…

MALICIOUS

PDF

39.6 KB Authoring application: Pdftk
MD5: 05aa8759c885592a613a2dd32ca14e39 SHA-1: 74c35beb397cc6a4c72c223a667d65e695a89e42 SHA-256: 84234e58b89914763cc118d6f3e748f4fca668fcbceb5f3da9498bacefa9e939
192 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a large number of embedded URLs, identified as a link farm, and is flagged by ClamAV as Pdf.Phishing.TtraffRobotInstall. The heuristic 'SE_PASSWORD_ARCHIVE_LURE' indicates the document likely instructs the user to open a password-protected archive, a common tactic to bypass gateway security. The embedded URLs are the primary indicators of malicious intent, suggesting a phishing or malware distribution campaign.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://raxusesakiture.weebly.com/uploads/1/3/0/3/130324324/73347182cbabeb5.pdf
    • http://ngravinggifts.shop/uploads/1/3/0/5/130551191/589370.pdf
    • http://crystalclearings.com/uploads/1/3/0/6/130621839/a0f86ed4228a94.pdf
    • http://ngsports.net/uploads/1/3/0/4/130483817/9ddb3b79320c6ee.pdf
    • http://prettysimpleorganizing.net/uploads/1/3/0/6/130639495/folegejadugomefebe.pdf
    • http://phoenixatlbsa.com/uploads/1/3/0/6/130639342/nedagud-xomoxoloraj-selusexikipu.pdf
    • http://ribbonbowsandmore.com/uploads/1/3/0/4/130490181/torupi.pdf
    • http://music4am.com/uploads/1/3/0/5/130543010/9248864.pdf
    • http://nicholselectrical.org/uploads/1/3/0/5/130590436/moset-togozofob-benafon-vajudex.pdf
    • http://shrinesearch.com/uploads/1/3/0/4/130435998/95781b859b0.pdf
    • http://mymissblue.com/uploads/1/3/0/2/130271243/130271243.html#harry+potter+and+the+prisoner+of+azkaban+free
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000012de.bin
5aa385ada3285bc470ddef15992c8832d5f604849348d560fc218ac02eed37a6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12DE 8904 bytes
font_01_sfnt_off000052a8.bin
b39b7001a8f9436074019f9ef4665bc1b059dffc24b0106b2299bbc47463e118		 pdf-font-stream PDF embedded font (sfnt) at offset 0x52A8 16468 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.