Malicious PDF — malware analysis report

Static analysis result for SHA-256 93bf5ef8ffe15933…

MALICIOUS

PDF

34.3 KB Authoring application: Nitro PDF
MD5: d67c851c28565b39f138606c03e56de9 SHA-1: 6d42ea4f502e96843fafb8b6421f12fcecbda16a SHA-256: 93bf5ef8ffe159339afc17011bcd8df58d5bb415bc91c86416f1bdf7596b9a09
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded URLs pointing to external PDF files, indicating a link farm or redirection mechanism. ClamAV and ML classifiers strongly suggest malicious intent, specifically identified as 'Pdf.Phishing.TtraffRobotInstall-7605656-0'. The document body, though heavily obfuscated, contains references to statistical calculations, likely a lure to disguise the malicious nature of the embedded links. The primary attack pattern involves directing users to a network of suspicious external sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.saratogaexit15.com/uploads/1/3/0/5/130551338/7140094.pdf
    • http://saharaexchange.com/uploads/1/3/0/7/130774966/6265504.pdf
    • http://my150reconcilliation.ca/uploads/1/3/0/4/130492771/remun-bijav-rutanexukabow.pdf
    • http://spayedkoolie.com/uploads/1/3/0/2/130272575/f9e983fd5.pdf
    • http://www.omni40.com/uploads/1/3/0/6/130621744/6018139.pdf
    • http://rkinternationals.com/uploads/1/3/0/5/130540882/19857.pdf
    • http://mothersfx.com/uploads/1/3/0/7/130740298/xakizalasoda_nososu_lujazogu_xulikaka.pdf
    • http://litrecruiting.com/uploads/1/3/0/7/130776719/6384578.pdf
    • http://hilltopoilma.com/uploads/1/3/0/4/130476347/da839e7a7.pdf
    • http://choosesani.com/uploads/1/3/0/6/130621865/7521879.pdf
    • http://www.tallgirlsshortbread.com/uploads/1/3/0/9/130968926/668034c.pdf
    • http://koshercomfort.com/uploads/1/3/0/5/130588517/wutugekixumax.pdf
    • http://thatguypt.com/uploads/1/3/0/5/130551166/130551166.html#how+to+calculate+mean+median+and+mode+in+statistics

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002e2f.bin
73f08f9a5429b38a3bad4490fbd09869d14657534187b39bcc30da90246ac0e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2E2F 7996 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.