Malicious PDF — malware analysis report

Static analysis result for SHA-256 8a38d3a1ccaecc6e…

MALICIOUS

PDF

45.0 KB Authoring application: Solid Converter PDF
MD5: a98b84149ce22fbaca913436dc1fc6e1 SHA-1: a28ef0d85fcfbe62f18285ccaa9e00bdfb78532b SHA-256: 8a38d3a1ccaecc6e6a7ac08ae5378f1da307f443bd2c99c9a414b18784c68881
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded links to external PDF files, a technique often used for SEO manipulation or to distribute malware. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the ML classifier output strongly indicate malicious intent. No scripts were extracted from this sample, but the sheer volume of outbound links suggests a campaign to drive traffic to potentially malicious sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://leblog.luludansmarue.org/uploads/1/3/0/8/130814055/demupojasasufowe.pdf
    • http://quartzplanning.com/uploads/1/3/0/5/130540366/2490096.pdf
    • http://norawahlbrink.com/uploads/1/3/0/2/130287997/7650094.pdf
    • http://notfadeawaymemoir.com/uploads/1/3/0/6/130604742/sifulezigetaji.pdf
    • http://photosandburritos.com/uploads/1/3/0/4/130478004/942a030721ccc67.pdf
    • http://hairextensionslive.com/uploads/1/3/0/5/130589279/godem-zedajino-mosugetizimiju-jovemil.pdf
    • http://dogodogo.ru/uploads/1/3/0/4/130476830/xewinuzalabo.pdf
    • http://mydarlingvalentine.com/uploads/1/3/0/7/130776763/9270077.pdf
    • http://insurequoterelief.com/uploads/1/3/0/7/130740262/9853821.pdf
    • http://propertiesbypaula.com/uploads/1/3/0/3/130313098/022c152d5a.pdf
    • http://singersandactorsworkshop.com/uploads/1/3/0/7/130739499/e8a27f.pdf
    • http://myforgottenself.com/uploads/1/3/0/4/130435937/tuxukalilu_lolologivowux_buxilemugo.pdf
    • http://cavumcloud.com/uploads/1/3/0/6/130605016/bea1c.pdf
    • http://naturallog.net/uploads/1/3/0/6/130620691/2384637.pdf
    • http://allhottub.com/uploads/1/3/0/7/130739261/nopajimupojuj.pdf
    • http://alanmaps.com/uploads/1/3/0/5/130542780/7611304.pdf
    • http://55florida.com/uploads/1/3/0/5/130550983/de31ce0b1e5d2b5.pdf
    • http://microbubblemaker.com/uploads/1/3/0/5/130588517/zudavixula.pdf
    • http://juliejesternewman.com/uploads/1/3/0/7/130776269/gifuwu-xejotevinumabup-warilu-lugegidigopikem.pdf
    • http://cottonginmuseum.org/uploads/1/3/0/3/130323209/tepod.pdf
    • http://oneaday.dance/uploads/1/3/0/5/130538870/fec6c47.pdf
    • http://earthmammablog.com/uploads/1/3/0/5/130543667/nokutazok.pdf
    • http://kerrydavies.net/uploads/1/3/0/4/130436173/3751873.pdf
    • http://tidaleffects.net/uploads/1/3/0/5/130588333/vezovunubapup.pdf
    • http://a1515530xstreamtravel.xsideas.com/uploads/1/3/0/5/130589415/130589415.html#tp+link+archer+ac2600+firmware
    • http://allhottub.com/upl

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003bce.bin
d5ed1c3e32e121bc7fdf4b7f64e9f52042883cdc8d0b4eb1f0c73bff7e2be32e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3BCE 4236 bytes
font_01_sfnt_off00004bd6.bin
8d148e2f1260375201e932c52cc551620eae85ccf69eb1e13ce3229e5fb2de5c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4BD6 8152 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.