Malicious PDF — malware analysis report

Static analysis result for SHA-256 845012b9dc44e11c…

MALICIOUS

PDF

39.5 KB Authoring application: Smallpdf Desktop
MD5: bec5d445f17886ddc171ae9ecdf2a594 SHA-1: 5ef60e12594b6422d5cbecfb916371bbfbd863d0 SHA-256: 845012b9dc44e11c76376fc777ea1f2b3c4b2f5f6e668f0cd792fa55f57ff0bf
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of external links, as indicated by the PDF_SEO_LINK_FARM heuristic. The ML classifier and ClamAV also flagged this file as malicious, specifically as Pdf.Phishing.TtraffRobotInstall. The embedded document body text mentions 'Affidavit letter for immigration marriage template', suggesting a lure to trick users into downloading further content. The primary attack pattern involves directing users to a network of external PDF files hosted on various domains.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://craftandcorkkitchen.com/uploads/1/3/0/7/130776516/f5720583.pdf
    • http://esa16.bpmtc.com/uploads/1/3/0/3/130324119/727af1ae8e9f.pdf
    • http://sittingwarrior.com/uploads/1/3/0/5/130589420/tafuser.pdf
    • http://theaanh.com/uploads/1/3/0/2/130288602/3668228.pdf
    • http://dreamamazingtravel.com/uploads/1/3/0/7/130738909/c1013e86.pdf
    • http://nelliejelly.com/uploads/1/3/0/4/130476322/7158796.pdf
    • http://dubairhythmicgymnastics.com/uploads/1/3/0/5/130588531/dapefezarenimadidu.pdf
    • http://fantasmador.com/uploads/1/3/0/4/130476205/volenumow.pdf
    • http://briaclee.com/uploads/1/3/0/7/130739696/welimewuvuwelokog.pdf
    • http://respond2gracefoundation.net/uploads/1/3/0/2/130272083/5820437.pdf
    • http://aldf.ca/uploads/1/3/0/5/130588942/mugefuvinuxofi.pdf
    • http://www.zafarsteel.com/uploads/1/3/0/5/130588278/wukawo_famosogilov_zuzutixozujin_zudololegiki.pdf
    • http://rajaampatdiveguide.com/uploads/1/3/0/5/130588564/punifogeradazuboxeso.pdf
    • http://crispandsmooth.com/uploads/1/3/0/4/130476168/fazozoriponajatuveri.pdf
    • http://noplacelikeahome.com/uploads/1/3/0/8/130814360/kenumukatugufav.pdf
    • http://norcalsquirrels.com/uploads/1/3/0/7/130740387/gevezerujafomi.pdf
    • http://thosjazz.com/uploads/1/3/0/5/130544385/69fce81d3a47b.pdf
    • http://bellecreekresources.net/uploads/1/3/0/2/130289457/vekuwaja.pdf
    • http://ninjaproxies.org/uploads/1/3/0/2/130289310/6f6a0127.pdf
    • http://webdisk.stefanaarnio.com/uploads/1/3/0/6/130604013/130604013.html#affidavit+letter+for+immigration+marriage+template
    • http://ninjaproxies.org/uploads/1/3/0/2/130

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003d8b.bin
7cb46453b0f29eb012811354a8330af4f183c6cd932ec407a767dfa8e56dcbca		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3D8B 7416 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.