Malicious PDF — malware analysis report

Static analysis result for SHA-256 9f8b226f574e1017…

MALICIOUS

PDF

36.1 KB Authoring application: PDF Studio
MD5: 27194392cf8099b0ae6f9431866af796 SHA-1: 3cc0a36801f9813e169d40be009a5173328c7129 SHA-256: 9f8b226f574e10179d4c82510982250927f80b6268a098c618c3e62393c9627f
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded URLs pointing to other PDF files hosted on various domains. This behavior is indicative of a link farm or SEO poisoning attack, designed to drive traffic to malicious content. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a phishing or traffic redirection motive. No scripts were extracted, and the document body content was heavily obfuscated and unreadable.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://a3arts.co.uk/uploads/1/3/0/2/130272360/dezedo.pdf
    • http://allentertainmentuk.com/uploads/1/3/0/4/130435682/2a43f6a23444.pdf
    • http://betrecordings.com/uploads/1/3/0/4/130488955/desosanasa-lovile-dakopum-bamuda.pdf
    • http://www.pediatricwellness2019.com/uploads/1/3/0/4/130488414/0d43e1d099b.pdf
    • http://nataliereneesteffen.org/uploads/1/3/0/8/130813135/1936602.pdf
    • http://sprovencher.com/uploads/1/3/0/6/130605179/b5b202.pdf
    • http://noblevictoryrock.com/uploads/1/3/0/2/130272389/9389840.pdf
    • http://susanseitz.com/uploads/1/3/0/7/130776786/xuboxa_fatatulu.pdf
    • http://www.jamielatashailluminated.com/uploads/1/3/0/4/130483110/3782d63eb9b0.pdf
    • http://myluriyubodyscrubs.com/uploads/1/3/0/5/130588731/lureja.pdf
    • http://remcofitness.com/uploads/1/3/0/2/130287930/919c47518.pdf
    • http://youandmeand.us/uploads/1/3/0/4/130478347/favetax_vuwiwelimoluz_nevudu.pdf
    • http://carrollcenter.org/uploads/1/3/0/4/130488252/4583256.pdf
    • http://womensmarchgarrettcounty.com/uploads/1/3/0/9/130969819/venalejona.pdf
    • http://alphcity.com/uploads/1/3/0/4/130475928/mikijoweduwam.pdf
    • http://paradiseuganda.net/uploads/1/3/0/8/130874197/6101076.pdf
    • http://racewarez.com/uploads/1/3/0/2/130289638/3b520915318c0.pdf
    • http://monagarciamusic.com/uploads/1/3/0/2/130272474/6407898.pdf
    • http://www.stevie-lea.co.uk/uploads/1/3/0/8/130813921/5025603.pdf
    • http://robertgertz.com/uploads/1/3/0/2/130270895/6b08cc.pdf
    • http://pleaseallowmetoillustrate.com/uploads/1/3/0/5/130588839/5898898.pdf
    • http://headblocks.org/uploads/1/3/0/9/130969002/130969002.html#what+are+advantages+and+disadvantages+of+full+wave+bridge+rectifier

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002eab.bin
1f3bd9226cce286b67edb1b5f127c4bb21ddc400be71aaba142b8aa892dda3d2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2EAB 7220 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.