Malicious PDF — malware analysis report

Static analysis result for SHA-256 ab8afc4c3367827e…

MALICIOUS

PDF

33.9 KB Authoring application: Serif PagePlus
MD5: 30d880156c2d11746ad6eae26b59087e SHA-1: 221b763be4df77767ad696d6feb28e33294493d4 SHA-256: ab8afc4c3367827ea955f2f444505c5cb00b0c8295e516f67e7f9e790df38377
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF file was flagged by ClamAV as Pdf.Phishing.TtraffRobotInstall-7605656-0 and a machine learning classifier. Static analysis revealed a large number of embedded URLs, indicating a link farm designed to redirect users. The document body contains text related to Agile testing methodology, which appears to be a lure to disguise the malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://activatemelbourne.com.au/uploads/1/3/0/8/130813931/1064875.pdf
    • http://murphyscybercafe.com/uploads/1/3/0/5/130588644/lutewo.pdf
    • http://sammiegeislerdpt.com/uploads/1/3/0/5/130589249/vinadam-bevijekunu-koguda.pdf
    • http://www.kiahkayser.com/uploads/1/3/0/6/130639477/2707613.pdf
    • http://gowickedkettlecorn.com/uploads/1/3/0/3/130323430/sinoluwukot.pdf
    • http://foilteeth.com/uploads/1/3/0/2/130288381/xawadoneso.pdf
    • http://pioneerriskmgmt.org/uploads/1/3/0/2/130271139/3039633.pdf
    • http://www.alpenkalk-streichputz.de/uploads/1/3/0/6/130621200/c4556b0b6cac.pdf
    • http://bobslocker.com/uploads/1/3/0/5/130588973/936458081.pdf
    • http://fifthel.com/uploads/1/3/0/4/130476144/rulef-roruzuxib-gexotoxen.pdf
    • http://princessrings.net/uploads/1/3/0/6/130605107/4017436.pdf
    • http://dxva.com/uploads/1/3/0/7/130739544/7b965c.pdf
    • http://jkjlawnsprinkler.com/uploads/1/3/0/4/130435891/2604417.pdf
    • http://qhgk3.bpmtc.com/uploads/1/3/0/5/130551876/130551876.html#agile+testing+methodology+pdf

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002d3b.bin
134b933be643c7c7b85070974dd525cc454108fad046a1b575e1536014beb6af		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2D3B 7436 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.