Malicious PDF — malware analysis report

Static analysis result for SHA-256 a2fbb2e6c2318465…

MALICIOUS

PDF

43.1 KB Authoring application: Inkscape
MD5: 25c16acf8932a8d166f5dd93ab2577fa SHA-1: f43d30b96242eafcdb8a997031b36a910280623e SHA-256: a2fbb2e6c231846543d27ca40203ad2f18519cdf36431b29e168c7deac5683d2
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded URLs pointing to other PDF files, a technique often used for SEO spam or to redirect users to malicious content. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the ML classifier's high confidence score further support a malicious classification. No scripts were extracted, limiting the analysis of direct execution capabilities.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://leprojetdememoire.com/uploads/1/3/0/5/130589194/xisojorubilulesaw.pdf
    • http://actionanimals.tv/uploads/1/3/0/7/130776889/bofog.pdf
    • http://www.clairethedoula.com/uploads/1/3/0/9/130969231/2002552.pdf
    • http://mysaleskitchen.com/uploads/1/3/0/9/130969439/8335236.pdf
    • http://justkiddingfranchise.com/uploads/1/3/0/6/130621179/875b64a.pdf
    • http://novayeastlabs.com/uploads/1/3/0/4/130483650/jakupaxosanatibet.pdf
    • http://legionsupplements.net/uploads/1/3/0/6/130605069/mifunimigunu-vinekaso-bogalisewume.pdf
    • http://puzzlesforprogress.com/uploads/1/3/0/6/130620283/59d05bcbf0.pdf
    • http://natalieeldridge.com/uploads/1/3/0/7/130738501/nupajepo.pdf
    • http://skattepartiet.se/uploads/1/3/0/4/130483244/92e5c2c2a26fc.pdf
    • http://www.findfastandbuy.com/uploads/1/3/0/9/130969588/7708021.pdf
    • http://www.tltaphouse.com/uploads/1/3/0/7/130739017/3555902.pdf
    • http://myvegandish.com/uploads/1/3/0/7/130775741/46db02428901.pdf
    • http://mail.www.kampfderkoeniginnen.ch/uploads/1/3/0/4/130435943/2655236.pdf
    • http://www.crispconnection.com/uploads/1/3/0/8/130814297/7279344.pdf
    • http://southislandhardwoodflooring.com/uploads/1/3/0/4/130483402/jinatadazegul-gegagob-xofuwixuriwof-javarap.pdf
    • http://grassrootsdrift.com/uploads/1/3/0/4/130483513/fe4e7e5cc29635.pdf
    • http://ncfse.com/uploads/1/3/0/4/130476538/mixenixatizoru_zurog_kofirowikuv_dufawagisug.pdf
    • http://kennedyclnew.devsite-1.com/uploads/1/3/0/5/130545333/130545333.html#recommendation+letters+for+masters+programs+sample

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004b57.bin
9ac2a80f1b366a8513b061396df59de8808cb6d2032d5d2bb1bfaf4a358719e5		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4B57 7884 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.