Malicious PDF — malware analysis report

Static analysis result for SHA-256 8a39706e90f2b4bb…

MALICIOUS

PDF

39.3 KB Authoring application: Poppler-utils
MD5: a995982e9903f9c97ea8efbaac8f2b15 SHA-1: 77b0ef1e06aa8c9545e819200ce1d95113296e0c SHA-256: 8a39706e90f2b4bb585dde5b598c5dd3755761343537e36ebd53f5dae8d03f70
150 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The PDF contains a large number of embedded URLs pointing to other PDF files, a technique often used for SEO spam or to distribute further malicious content. ClamAV identified this as 'Pdf.Phishing.TtraffRobotInstall-7605656-0', and a machine learning classifier also flagged it with high confidence. The document body text is largely garbled but contains references to Adobe and file size reduction, potentially a lure.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://lincolnbailbonds.net/uploads/1/3/0/7/130740068/datidopaz.pdf
    • http://abmaquiladora.com/uploads/1/3/0/4/130476740/kavinof.pdf
    • http://golfboardu.com/uploads/1/3/0/6/130621651/fafebikixulox.pdf
    • http://triadstartup.com/uploads/1/3/0/6/130639808/7242066.pdf
    • http://justbcosmetics.com/uploads/1/3/0/4/130489019/0a306.pdf
    • http://twalight.com/uploads/1/3/0/5/130540178/8655170.pdf
    • http://marijuanacultivationconsultants.com/uploads/1/3/0/6/130604109/e0b89c3e1.pdf
    • http://fqualitywallsllc.com/uploads/1/3/0/6/130604864/7033749.pdf
    • http://allstarscomedyentertainment.com/uploads/1/3/0/5/130588847/xepotajugopuzusug.pdf
    • http://www.gibbytheclown.com/uploads/1/3/0/7/130775084/934849.pdf
    • http://rose-from-concrete.com/uploads/1/3/0/5/130545475/6be7311e1f9c0.pdf
    • http://theinnonsilverlake.com/uploads/1/3/0/6/130604215/b1a0d7.pdf
    • http://dailycoinwatch.com/uploads/1/3/0/6/130639091/nepow.pdf
    • http://misscamille.fr/uploads/1/3/0/5/130550762/0e5b17ef7013.pdf
    • http://mistyislandbernese.com/uploads/1/3/0/6/130603959/c4c2738.pdf
    • http://www.tweetsbyandre.com/uploads/1/3/0/5/130551756/nigamikedibav.pdf
    • http://userfriendlyfaith.com/uploads/1/3/0/7/130739654/javaleginojukus_nosafojo_zamanudo_zodarikesodomop.pdf
    • http://webmail.jhigh18.com/uploads/1/3/0/5/130551943/130551943.html#como+disminuir+el+tama%C3%B1o+archivo+pdf

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003c9d.bin
28e12eb5ec4f9ff02bed8060ec9a3e8e4dd902532502acce8806a987b8f6f583		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3C9D 8536 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.