Malicious PDF — malware analysis report

Static analysis result for SHA-256 a1c0092fa3b8b670…

MALICIOUS

PDF

76.5 KB Authoring application: SWFTools
MD5: 9afdc2bbba0263e6a0b793d820c39c7d SHA-1: 6dc9d7ddff3a04223bcda79b48ffc3966e770a51 SHA-256: a1c0092fa3b8b67077d897ac9cd705db2acdb4be48bff95a77afb62f86f6bf84
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious File

The PDF contains a large number of embedded links to external PDF files, a technique often used for SEO spam or to distribute malicious content. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the ML classifier strongly indicate malicious intent. The document body itself is heavily obfuscated and contains a mix of text and what appears to be corrupted data, making its direct purpose unclear beyond the linked URLs.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://appleplayschools.info/uploads/1/3/0/5/130589216/fb23a8acaeb.pdf
    • http://44michigan.com/uploads/1/3/0/8/130814680/7302878.pdf
    • http://quanqiu.org/uploads/1/3/0/2/130288589/gufeka_rumedanebuboj_papese.pdf
    • http://fengshuiyongpin.com/uploads/1/3/0/8/130873937/kapibowigusa.pdf
    • http://bikefishski.com/uploads/1/3/0/6/130620159/4001209.pdf
    • http://www.ibbooksandcredits.com/uploads/1/3/0/4/130488512/8bc2570da6c55f2.pdf
    • http://campuscircle.org/uploads/1/3/0/6/130621310/riwidalatitu-mekiguxaxim-zubel.pdf
    • http://bitcoinersnow.com/uploads/1/3/0/7/130775822/pewubowijosiva-benad-leduxesoxe.pdf
    • http://socohomephotography.com/uploads/1/3/0/3/130379371/ea579.pdf
    • http://jailhouselawyers.com/uploads/1/3/0/5/130588502/petufe_togek_bukomo.pdf
    • http://westcoastphotoservice.com/uploads/1/3/0/7/130776219/zaxofusin.pdf
    • http://ncmaf.com/uploads/1/3/0/6/130621775/5935562.pdf
    • http://merz-verlag-en.com/uploads/1/3/0/5/130542924/1503813.pdf
    • http://naturalisllc.net/uploads/1/3/0/5/130588468/56fcffa9.pdf
    • http://tedmakes.com/uploads/1/3/0/3/130323908/dafibe.pdf
    • http://designadrum.com/uploads/1/3/0/6/130621758/birasefivedumolinu.pdf
    • http://campingdishwasher.com/uploads/1/3/0/8/130815013/1362050.pdf
    • http://equilibrium21.online/uploads/1/3/0/8/130874250/tefejapuxabenenuv.pdf
    • http://dryerbeats.com/uploads/1/3/0/7/130740062/7801046.pdf
    • http://attiliosfarms.com/uploads/1/3/0/5/130548192/soluxunixeju.pdf
    • http://suburbansubarucrosstrek.com/uploads/1/3/0/4/130488410/jafiwi.pdf
    • http://kimghattas.net/uploads/1/3/0/5/130590092/3563982.pdf
    • http://mollytriplettphotography.com/uploads/1/3/0/7/130775346/9791719.pdf
    • http://mydanielswaterfrontcondo.com/uploads/1/3/0/6/130639926/090a50c.pdf
    • http://liviace.me/uploads/1/3/0/6/130639278/liputodimafokoje.pdf
    • http://fxu14.bpmtc.com/uploads/1/3/0/6/130605368/130605368.html#kasus+abortus+komplit
    • http://suburbansubarucrosstrek.com

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003b13.bin
3e8dc6f0a1c6573a3eab8ce9c7a619fba7123700431b7fd34a2559bb4f0392d7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3B13 8128 bytes
font_01_sfnt_off0000f335.bin
170e68efebbea4ac53d388cea3b3ca4690bcd59dbb01c028511441e1970c0e1d		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF335 1732 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.