Malicious PDF — malware analysis report

Static analysis result for SHA-256 9ba3cbd09b291526…

MALICIOUS

PDF

46.2 KB Authoring application: Pdftk
MD5: ef33762d7252ccd59f93d00ab54081ba SHA-1: daca5459f09d298295f9ff526344d393c695da81 SHA-256: 9ba3cbd09b291526339a3b62991668a58cd9596ccba0092e0669e65a3b766198
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded URLs pointing to external PDF files, a technique often used for SEO manipulation or to distribute malicious content. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the ML classifier strongly indicate malicious intent. The heuristic 'PDF_SEO_LINK_FARM' confirms the presence of a link farm, suggesting the primary purpose is to redirect users to potentially harmful sites.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://avikat.com/uploads/1/3/0/2/130272424/gijut.pdf
    • http://rayrobbinsagency.com/uploads/1/3/0/5/130546118/tibafa-ropuvitoxe-zitabijaru-midoxi.pdf
    • http://101bamboofins.com/uploads/1/3/0/5/130590244/saxoxigiw-firabizewoti-miwepetej.pdf
    • http://jennifferdiaz.net/uploads/1/3/0/4/130435596/mupuxeguvux_nokoxuzonerure_punereju_zolukamulorijav.pdf
    • http://dodgeofneworleans.com/uploads/1/3/0/5/130588206/notilogo_vogejotemuner_mekuvotopovuj.pdf
    • http://wouldbedelighted.com/uploads/1/3/0/7/130739093/zafitobow-riwemit-vijominoke.pdf
    • http://webdisk.nonnaandtheboss.com/uploads/1/3/0/4/130476574/8243505.pdf
    • http://lattaconsultants.com/uploads/1/3/0/2/130287737/f0ba9c73a0443.pdf
    • http://www.hdantenna-dayton.com/uploads/1/3/0/8/130814408/2011748.pdf
    • http://funmovienight.com/uploads/1/3/0/4/130483895/5520383.pdf
    • http://www.heathershuker.com/uploads/1/3/0/2/130272501/sazumakera.pdf
    • http://bwhousein.com/uploads/1/3/0/4/130435763/9e265690050f6.pdf
    • http://imaginarylabs.net/uploads/1/3/0/3/130379523/8f7de6.pdf
    • http://tuxebase.com/uploads/1/3/0/6/130640190/refoxo-popaxatovagega.pdf
    • http://www.mjarden.com/uploads/1/3/0/6/130639335/01538.pdf
    • http://arcticethics.org/uploads/1/3/0/6/130620568/5535225.pdf
    • http://greenbullco.com/uploads/1/3/0/5/130539215/5aecd.pdf
    • http://www.1gospelofgod.com/uploads/1/3/0/4/130483067/3695947.pdf
    • http://bearsvsbabies.org/uploads/1/3/0/5/130589108/fb091.pdf
    • http://www.jealousoftheex.com/uploads/1/3/0/6/130620509/lawovuzelotu_xakimudedi_bakagazukofi.pdf
    • http://hostmaster.insiderrisk.co.uk/uploads/1/3/0/2/130289686/mamaxamofivad.pdf
    • http://milestoneshomeinspections.net/uploads/1/3/0/5/130546294/3588195.pdf
    • http://www.navinamisir.com/uploads/1/3/0/7/130775299/2b234c.pdf
    • http://gnsi7.bpmtc.com/uploads/1/3/0/6/130639563/130639563.html#biology+project+malaria

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000516c.bin
de14abf69330241cf718fe388f0cf72666ca7d5aa0976eabaac6d6e8356135ec		 pdf-font-stream PDF embedded font (sfnt) at offset 0x516C 8344 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.