Malicious PDF — malware analysis report

Static analysis result for SHA-256 a699767c35c29309…

MALICIOUS

PDF

42.6 KB Authoring application: pstoedit
MD5: 1d8d3da5445c8820932673db1859d27b SHA-1: b1dbdce497da237116544134e908a508d6a5d740 SHA-256: a699767c35c293096ac1c7894b11f41484db50355331d59ac3e97aa37acc25a4
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1566.002 Spearphishing Link

The PDF contains a large number of embedded external links, a technique often used for SEO manipulation or to distribute malicious content. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the ML classifier strongly indicate malicious intent. The document body itself is heavily obfuscated and appears to be related to PDF conversion tools, likely a lure.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://comtec.ch/uploads/1/3/0/6/130604315/5699960.pdf
    • http://mydatadriven.com/uploads/1/3/0/6/130639267/wodamevani.pdf
    • http://allaboutalyssam.com/uploads/1/3/0/2/130289392/doxatofavim.pdf
    • http://batteryparkschool.com/uploads/1/3/0/6/130603682/xebifilurizodu.pdf
    • http://uphoneitin.com/uploads/1/3/0/7/130775396/witumununuwak-lasiwomir-mopipesuzeribe-bebuwugeregi.pdf
    • http://chunkeymonkey40.com/uploads/1/3/0/8/130814675/muzin.pdf
    • http://sontimes.org/uploads/1/3/0/7/130740231/wuvejademaw.pdf
    • http://nativologie.com/uploads/1/3/0/5/130551536/dularoravi.pdf
    • http://webdisk.slavicsacramento.org/uploads/1/3/0/5/130588515/7224163.pdf
    • http://gloria.consulting/uploads/1/3/0/5/130589009/wolokuwu_koxogadaburotil_vazazaluk_bateno.pdf
    • http://zenergieconseil.com/uploads/1/3/0/6/130620506/9057688.pdf
    • http://vediskastrologi.dk/uploads/1/3/0/5/130590287/gogivegigonet.pdf
    • http://detailinggreensboro.com/uploads/1/3/0/5/130541745/luwererudawe.pdf
    • http://naturesworks.net/uploads/1/3/0/6/130604366/genokiwojid_pesalarerebi_janakufu.pdf
    • http://www.stepup.london/uploads/1/3/0/3/130313150/lixuxog.pdf
    • http://motivationalresearch.org/uploads/1/3/0/2/130289581/nevepes-lexarezam.pdf
    • http://ciggysound.com/uploads/1/3/0/6/130620348/130620348.html#pagemaker+file+to+pdf+converter+online+free

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003ffe.bin
41d5c9cb4d60b7530e3cfd93a78efd430fe179aa57a8296e74fb8a971da4b0ee		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3FFE 2600 bytes
font_01_sfnt_off00004b98.bin
7fde545f800cb9a89d8c0ce72f792d6a3c1a473eafeda404ca1b1f27a23edd65		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4B98 7656 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.