Malicious PDF — malware analysis report

Static analysis result for SHA-256 9887499f0e7d6109…

MALICIOUS

PDF

70.2 KB Authoring application: SWFTools
MD5: b28fd67afff096144ea918ca9e4a138b SHA-1: b0eff67328c7dc41f3b197be97c1aa340b1167db SHA-256: 9887499f0e7d61093517df8b550aba8e1b7445703bc2fe9457d2b530166fc425
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links to external PDF files hosted on various domains. This behavior is indicative of SEO spam or a link farm designed to distribute malicious content or redirect users to phishing sites. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports the malicious classification.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.shaylaecole.com/uploads/1/3/0/3/130313641/d3285c11d4.pdf
    • http://www.ashokchopra.com/uploads/1/3/0/6/130620640/pasememiwefariwenal.pdf
    • http://puttwell.golf/uploads/1/3/0/6/130604458/1612508.pdf
    • http://www.consoleduel.com/uploads/1/3/0/6/130604770/7006749.pdf
    • http://skitheoutdoors.com/uploads/1/3/0/6/130604111/zamoweseguvisoxuf.pdf
    • http://shrinkmeketo.com/uploads/1/3/0/6/130639537/befc0772253c.pdf
    • http://www.auxvieuxmeubles1617.com/uploads/1/3/0/5/130588424/vurumifowekazon.pdf
    • http://atelierjpb.com/uploads/1/3/0/5/130540293/ninemu.pdf
    • http://999fmradiomanila.com/uploads/1/3/0/2/130288729/9428232.pdf
    • http://mssugarscloset.com/uploads/1/3/0/5/130590545/kojefazaga_tajapek.pdf
    • http://www.vividperformanceandpt.com/uploads/1/3/0/5/130588513/tajopamoxuwemijib.pdf
    • http://www.anuskinesthetics.com/uploads/1/3/0/4/130476048/kumarirazanekegiw.pdf
    • http://assortedartistries.net/uploads/1/3/0/6/130604026/nasitufewegi-pofifomajux-labimirati.pdf
    • http://nothingtotriflewith.com/uploads/1/3/0/6/130620579/pedowopaxonag.pdf
    • http://www.oxography.com/uploads/1/3/0/9/130969311/130969311.html#gujarat+samachar+epaper+rajkot+yesterday

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007039.bin
fb7175ccf0d29b81a6835aef9a3eb9762cae01dc01cc88db0dbecf20597aabb4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7039 29700 bytes
font_01_sfnt_off0000b9b4.bin
c6d90c46d79f9be85dff0f651a7701eb515f37adf3a0df1b7aa8907f8e1a3479		 pdf-font-stream PDF embedded font (sfnt) at offset 0xB9B4 8372 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.