Malicious PDF — malware analysis report

Static analysis result for SHA-256 91a23170d96ca78b…

MALICIOUS

PDF

42.4 KB Authoring application: Serif PagePlus
MD5: c4b1c0a94adad118d99600673009fe1e SHA-1: 6e0944e4305fd785ba86eac2e0c667e0f1ee5667 SHA-256: 91a23170d96ca78b12b16c5587d5d2161284bbb6fb1fcc83d4b932b566461c88
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious File

The PDF contains a large number of embedded links to external PDF files, a technique often used for SEO manipulation or to distribute malicious content. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the ML classifier output strongly indicate malicious intent. No scripts were extracted from this sample, but the sheer volume of outbound links suggests a coordinated effort to drive traffic or distribute malware.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://youngprofessionalsofsanfrancisco.com/uploads/1/3/0/5/130551066/3533466.pdf
    • http://thedecoratorseye.com/uploads/1/3/0/6/130605315/8910740.pdf
    • http://dreamasweetdream.com/uploads/1/3/0/5/130551130/2771444.pdf
    • http://fiveandlime.com/uploads/1/3/0/6/130620637/juserabal.pdf
    • http://rogersbellappleiphonereadreceiptssamsung.com/uploads/1/3/0/6/130604197/tokepoxo_siwaxebuluxax_kozego.pdf
    • http://sheaandaloe.com/uploads/1/3/0/4/130475990/juxixi.pdf
    • http://thehappylifeacademy.com/uploads/1/3/0/4/130489914/7e8eba.pdf
    • http://urbanrips.com/uploads/1/3/0/5/130589452/2b0c5b22dcd.pdf
    • http://sceneguide.net/uploads/1/3/0/6/130604542/d2e00193.pdf
    • http://bankruptcyattorneycapecoral.org/uploads/1/3/0/5/130539241/wefow-tiwuwurogonuso-fikifapa-wazozige.pdf
    • http://charmgurl.com/uploads/1/3/0/6/130639535/redujekudidak.pdf
    • http://treehousehashomes.com/uploads/1/3/0/6/130621384/f908c64cf3.pdf
    • http://vijayinderkaran.in/uploads/1/3/0/2/130289467/554983.pdf
    • http://kcbbc.org/uploads/1/3/0/5/130590047/tutuzomumev-gixodubizoro-xarifosusugis-taxasad.pdf
    • http://mcqjz.bpmtc.com/uploads/1/3/0/5/130539584/130539584.html#best+resignation+letter+ever+pdf

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000033b9.bin
779aa567746046747dac965df7fdfb06ff632674a0a99ce247a327bf89f0fa63		 pdf-font-stream PDF embedded font (sfnt) at offset 0x33B9 16036 bytes
font_01_sfnt_off00004ad4.bin
c1cb7231575c974a5cb722fba43687800d6b365ab13c2e61fe415dff2e4c4c72		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4AD4 8156 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.