Malicious PDF — malware analysis report

Static analysis result for SHA-256 aae996478433b6e7…

MALICIOUS

PDF

36.6 KB Authoring application: Pdftk
MD5: 04a36198a487a36791854a368fa77455 SHA-1: 7e3b17461f122c2fed2a411ae7cb794041c5d1a6 SHA-256: aae996478433b6e7e0d34008ebf65d24887e7241e2c1190f5bb5bb7af8c348da
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded external links, as indicated by the PDF_SEO_LINK_FARM heuristic. These links point to various domains, suggesting a link farm or SEO manipulation tactic. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a malicious intent, likely related to phishing or traffic redirection. No scripts were extracted from this sample, limiting the ability to determine specific payload delivery mechanisms.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://bigmischiefproductions.com/uploads/1/3/0/6/130621051/3995032.pdf
    • http://justinalfond.net/uploads/1/3/0/4/130476978/8ef7b.pdf
    • http://bigscarythings.com/uploads/1/3/0/2/130288523/kokare.pdf
    • http://creativeworkroom.net/uploads/1/3/0/6/130620902/navusawirivaz_mibibaxim_naxal.pdf
    • http://sowmyapelluru.com/uploads/1/3/0/6/130603900/d42427590ee7.pdf
    • http://myhralacarte.com/uploads/1/3/0/5/130550724/5279ce94c911.pdf
    • http://dentistcfo.com/uploads/1/3/0/7/130739340/4595791.pdf
    • http://sallysfitnessfortress.com/uploads/1/3/0/4/130435583/5861011.pdf
    • http://tampabayimprovfestival.com/uploads/1/3/0/2/130289158/tajamizarutimor.pdf
    • http://koasportsmedia.com/uploads/1/3/0/7/130739830/mazotaloba-besefepov-filipivopudu.pdf
    • http://nomoremessingaround.com/uploads/1/3/0/6/130640102/pulimiboka_kepevafotov_vojudepugi.pdf
    • http://deli-sushi.com/uploads/1/3/0/7/130776101/bejumukareveweb.pdf
    • http://saltlakecitybarbershop.com/uploads/1/3/0/4/130488847/jenurosafuda-munozofeju-kukamuguzujabov-majamizuka.pdf
    • http://galadus.pl/uploads/1/3/0/8/130813132/dijegojo.pdf
    • http://xn--c1aanafncj4aa9da2gcbc.xn--l1acc/uploads/1/3/0/6/130604083/830294bf.pdf
    • http://italiandental.show/uploads/1/3/0/5/130589320/33445487f24.pdf
    • http://teaandentertaining.com/uploads/1/3/0/4/130435805/xosafowufijexo.pdf
    • http://ngbeautymakeupstore.com/uploads/1/3/0/6/130604833/tigoxavudu.pdf
    • http://undividedmedia-org.roryvincent.com/uploads/1/3/0/8/130814909/a08cd34569.pdf
    • http://melaniegarunay.com/uploads/1/3/0/7/130775241/nodezepavix_lizixunipugalup.pdf
    • http://travelandthrift.com/uploads/1/3/0/4/130483566/jufowixilozo_fawudirexubet_soxuwepevaz.pdf
    • http://albaydar.net/uploads/1/3/0/7/130739153/130739153.html#ielts+general+training+reading+mock+test+pdf
    • http://koasportsmedia.com/uploads/1/3/0/7/130739830/mazotaloba-besefepov-filipivopudu.p

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002ecf.bin
4fe1305b0a4e6dd126b9a4c3cf870d2c4a461c993096e171525bec4201a3d1de		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2ECF 7652 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.