Malicious PDF — malware analysis report

Static analysis result for SHA-256 8ecf98750b0dee3c…

MALICIOUS

PDF

102.4 KB Authoring application: PDFBox
MD5: 0691c3af15773dfc8c7db3e85d125cf1 SHA-1: 14a3334c4b059753864b574800c6d94c739c2970 SHA-256: 8ecf98750b0dee3c9d1513fe7cb0ffa36d452a93da50f5a4a24c54f1e2f3d1f3
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded external links, a technique often used for SEO manipulation or to distribute malware. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the critical heuristic 'PDF_SEO_LINK_FARM' strongly indicate a malicious intent to redirect users to potentially harmful content. No scripts were extracted, but the sheer volume of links suggests a distribution or redirection campaign.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9979

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://msg-ec.com/uploads/1/3/0/2/130289809/3c6cfd28e6.pdf
    • http://crownway.org/uploads/1/3/0/4/130488332/wimikokosag_ninegipezo_lixisiwowuluro.pdf
    • http://anandalaketahoe.com/uploads/1/3/0/4/130435652/kigij-gofakaritekamid-fabimixite-pavidotekizema.pdf
    • http://ekcoelearningcommons.com/uploads/1/3/0/6/130621149/tolupafopu.pdf
    • http://4n0.com/uploads/1/3/0/6/130620757/e0edcd52230.pdf
    • http://totahr.com/uploads/1/3/0/5/130550854/6d020688210.pdf
    • http://quartzvanitydirect.com/uploads/1/3/0/5/130589205/vases.pdf
    • http://nexuschapel.org/uploads/1/3/0/2/130288811/gasaxetinez_kuvikan.pdf
    • http://morrisboydphotography.com/uploads/1/3/0/4/130488604/57fba47e6efbc0.pdf
    • http://mynaturalhairspa.com/uploads/1/3/0/6/130605292/130605292.html#mccombs+e+shaw+1972

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000013cb.bin
c350d2540d3939252f3ded80552346ebc73b4953779898bc1df0df004e46926b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13CB 9452 bytes
font_01_sfnt_off0000d010.bin
41d5c9cb4d60b7530e3cfd93a78efd430fe179aa57a8296e74fb8a971da4b0ee		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD010 2600 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.