Malicious PDF — malware analysis report

Static analysis result for SHA-256 98751ba45219b64d…

MALICIOUS

PDF

37.9 KB Authoring application: Pdftk
MD5: e3d7d4fbb4d393bbfe192c1d05e94f9e SHA-1: e64f74cd0520c01a1c70c78aa46286bf141ce3df SHA-256: 98751ba45219b64df3f3a912f9bfd510ea10eccc7cd8bbcfef8d1df29a5f3fd4
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded URLs pointing to external PDF files, a technique often used for SEO manipulation or to distribute malware. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the ML classifier's high confidence score further support a malicious intent. No scripts were extracted from this sample, limiting the ability to determine specific payload delivery mechanisms.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://equestriansupply.co.nz/uploads/1/3/0/6/130604173/6577813d.pdf
    • http://nwprogressive.us/uploads/1/3/0/4/130493476/ecfe6.pdf
    • http://gameandsoft.store/uploads/1/3/0/2/130272420/5646675.pdf
    • http://miekebreukelen.com/uploads/1/3/0/3/130313440/3392572.pdf
    • http://michaelrekas.com/uploads/1/3/0/6/130621900/gezakidobipure-zizizubugon-nujojabumamevod-zisij.pdf
    • http://irc4hr.net/uploads/1/3/0/6/130621267/3350424.pdf
    • http://manylabs.net/uploads/1/3/0/6/130620730/8397615.pdf
    • http://mvillstyles.com/uploads/1/3/0/6/130621418/rebosageduzaja-legowab-pevegogugizix-bipemewapimon.pdf
    • http://mobotflexi.com/uploads/1/3/0/6/130604288/zutetovovaku.pdf
    • https://pusuzifavawazu.weebly.com/uploads/1/3/0/6/130604363/8c3c5a665bede33.pdf
    • http://wolfgangbaur.com/uploads/1/3/0/5/130552016/pajanirudabor.pdf
    • http://milestoneshomeinspections.net/uploads/1/3/0/6/130604215/dagulomafojov.pdf
    • http://blueskycenteronline.com/uploads/1/3/0/2/130272330/regusajuw.pdf
    • http://commstech-hub.eisf.eu/uploads/1/3/0/2/130288430/8b6d0aabf488.pdf
    • http://bucketsofbrassandcopper.com/uploads/1/3/0/5/130539672/7deca3149591e4.pdf
    • http://christinalozanofier.com/uploads/1/3/0/7/130738546/nutiwumo.pdf
    • http://san69.com/uploads/1/3/0/5/130544878/dinipukiwivajidiwuw.pdf
    • https://dexuvowuk.weebly.com/uploads/1/3/0/2/130270867/9333040.pdf
    • http://narchack.com/uploads/1/3/0/4/130483799/4714498.pdf
    • http://antiviruseprotectserviceonline.site/uploads/1/3/0/7/130740330/130740330.html#acupressure+potent+points+for+cats
    • http://gameandsoft.store/uploads/1/3/0/2/13027242

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003577.bin
7d54b447d3102b2e1a196e9d4d2b5dde16002d80d0ab6cd752293ee4ab9b5acf		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3577 7960 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.