Malicious PDF — malware analysis report

Static analysis result for SHA-256 a17c9e08b7a9834b…

MALICIOUS

PDF

34.9 KB Authoring application: Soda PDF
MD5: e9b579284fa742f8319498f71a985a28 SHA-1: b6e60a377b51bba27e66bbdf18c3cccff76758c2 SHA-256: a17c9e08b7a9834b606f8bf0c77987b20b8777a4808adde82d080864195841cd
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic, suggesting a link farm or phishing lure. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall' further supports a phishing or malicious redirection intent. The document body, though partially corrupted, mentions 'Solving quadratic equations by graphing calculator worksheet', which could be a pretext to encourage users to click the embedded links.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ways2life.com/uploads/1/3/0/7/130775592/1475537.pdf
    • http://colossalconversions.com/uploads/1/3/0/6/130639960/gofogosirusetitemugo.pdf
    • http://bibleandbedhead.com/uploads/1/3/1/0/131070590/doresukalepevazibi.pdf
    • http://capcitytravelball.com/uploads/1/3/0/5/130539553/1873832.pdf
    • http://read.genevamanilova.com/uploads/1/3/0/7/130775518/0a482f0a8fd5ddd.pdf
    • http://apiaconsulting.net/uploads/1/3/0/6/130639054/7936686.pdf
    • http://travelgai.com/uploads/1/3/0/8/130813305/mowimufemifa.pdf
    • http://apacint.com.au/uploads/1/3/0/6/130603841/2ac6f7a04.pdf
    • http://princestreetam.com/uploads/1/3/0/7/130776123/mefapubik_jikewunalutoduw.pdf
    • http://floorble.com/uploads/1/3/0/3/130313555/taruwofeluzoru.pdf
    • http://undergroundnola.com/uploads/1/3/0/4/130483429/vuxazigigid-fisol-sefogez-wijok.pdf
    • http://mta-sts.mapost75.com/uploads/1/3/0/8/130874411/dixasiju.pdf
    • http://jerryshardwarema.com/uploads/1/3/0/9/130969830/ganajekosutus.pdf
    • http://danlynnwatt.com/uploads/1/3/0/4/130483413/wugivabozosubagudaw.pdf
    • http://feriadelmecanico.com/uploads/1/3/0/7/130776177/kajizenoxudu.pdf
    • http://realitycure.com/uploads/1/3/0/7/130738635/lekokosadisuf.pdf
    • http://mail.perfectpairmeals.com/uploads/1/3/0/2/130288565/8527834.pdf
    • http://chloelgroup.com.au/uploads/1/3/0/7/130739987/d48bebc2202.pdf
    • http://www.bristolpianist.co.uk/uploads/1/3/0/5/130544725/bogorolem.pdf
    • http://lebaijiaguojiyule.br3h.com/uploads/1/3/0/5/130539763/130539763.html#solving+quadratic+equations+by+graphing+calculator+worksheet
    • http://danlynnwatt.com/uploads/1/3/0/4/130483413/wugivab

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000295f.bin
c892b0052654af08cb94d388a0168fb034c9fa92023f5fd16cbcf6fa409b605b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x295F 7896 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.