Malicious PDF — malware analysis report

Static analysis result for SHA-256 86b2eabb9b8c6224…

MALICIOUS

PDF

43.1 KB Authoring application: ImageMagick
MD5: 6b404e117fb1a1187abdead1bb293858 SHA-1: 564cad8ea80c34131299df189a7ce3ba239c3349 SHA-256: 86b2eabb9b8c62244bb946295f4b0740dad7cb188599926700c2c23d5f9cbcc8
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic, which is indicative of a link farm or phishing campaign. The ClamAV detection as Pdf.Phishing.TtraffRobotInstall-7605656-0 further supports the malicious nature of this file. The embedded URLs likely lead to further malicious content or phishing pages.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.awayoverseas.com/uploads/1/3/0/6/130620424/netarijuf.pdf
    • http://wundrmediapro.com/uploads/1/3/0/6/130605422/winetadebile-febol-jipase-nekadedu.pdf
    • http://chhsports.com/uploads/1/3/0/6/130639481/ruxuvinakor.pdf
    • http://orangecountyflamenco.com/uploads/1/3/0/5/130542852/2906269.pdf
    • http://kimchibabe.com/uploads/1/3/0/3/130379266/3533806.pdf
    • http://b13ind.com/uploads/1/3/0/6/130604667/1168099.pdf
    • http://cardinaltranscribing.com/uploads/1/3/0/3/130313156/1379235.pdf
    • http://growtem.com/uploads/1/3/0/5/130588270/sovixenoma.pdf
    • http://annawitenberg.com/uploads/1/3/0/7/130739127/2327232.pdf
    • http://cheyenne-janas.com/uploads/1/3/0/4/130488105/fenopamesobu_xoferipa.pdf
    • http://becomeayogatherapist.com/uploads/1/3/0/2/130271179/9095545.pdf
    • http://hostmaster.twmsp.com/uploads/1/3/0/7/130739210/ziniwavupazutiw_xabasonuluw.pdf
    • http://hostmaster.tribetour.org/uploads/1/3/0/5/130543364/bogimo.pdf
    • http://mirrorimagedanceteam.com/uploads/1/3/0/7/130775916/3965098.pdf
    • http://marketdragon.net/uploads/1/3/0/6/130604739/sujut.pdf
    • http://www.karenlaurapeters.com/uploads/1/3/0/5/130540559/firobuk_wugaxuminum_kowozonuxi_tojulubo.pdf
    • http://nationalbrainhealth.org/uploads/1/3/0/5/130551739/nevixupekiwef-dolusanukuz-wikixi.pdf
    • http://afterdarkboutique.org/uploads/1/3/0/6/130605228/1803874.pdf
    • http://mobilservredlist.com/uploads/1/3/0/2/130270762/7596329.pdf
    • http://aircompressorfluids.com/uploads/1/3/0/7/130776822/safut-tasanugonumowi.pdf
    • http://host202.carmichaelnl.com/uploads/1/3/0/7/130775702/130775702.html#s%C3%ADndrome+de+abstinencia+alcoh%C3%B3lica+pdf

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004918.bin
c1d6d40a841833c1b372201d90f93b46610384487dfe51fdcdb94d63f721c91e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4918 8508 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.