Malicious PDF — malware analysis report

Static analysis result for SHA-256 ac04a1eccb5dbe5f…

MALICIOUS

PDF

65.7 KB Authoring application: ImageMagick
MD5: 1e95b9326d834df0c02653c5a31411df SHA-1: 802eb6133a0ccb5262a971aa1e1bc9a2150ad8f9 SHA-256: ac04a1eccb5dbe5fd07bb694997c861de42091feabb452aa12ee1f243de0c08c
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF file was flagged by multiple heuristics, including a critical PDF_SEO_LINK_FARM rule and ClamAV detection as Pdf.Phishing.TtraffRobotInstall-7605656-0. The ML classifier also assigned a high probability of maliciousness. The primary attack pattern observed is the embedding of a large number of external PDF links, suggesting a traffic redirection scheme. The document body is heavily obfuscated and unreadable, providing no direct clues to the user-facing lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://mikebarnescoach.com/uploads/1/3/0/4/130476456/515221.pdf
    • http://movinion.com/uploads/1/3/0/7/130776208/tedajazokuwifon.pdf
    • http://alfredspace.com/uploads/1/3/0/3/130379114/b31d8b77.pdf
    • http://northoftime.com/uploads/1/3/0/7/130738635/luzerapunet.pdf
    • http://mx.artbypasta.com/uploads/1/3/0/4/130488153/kurijufekiseto.pdf
    • http://planagmatandgreacademy.com/uploads/1/3/0/9/130969077/228815.pdf
    • http://ncssomerset.org/uploads/1/3/0/8/130814011/d48cb1674e5c1.pdf
    • http://unreeldance.ca/uploads/1/3/0/6/130620976/kovugelujix.pdf
    • http://februaryvioletwedding.com/uploads/1/3/0/5/130590208/reramova.pdf
    • http://sendygiamatteipictures.com/uploads/1/3/0/8/130813797/3304731.pdf
    • http://west-coast-round-house.com/uploads/1/3/0/3/130323131/e4115ba7c3c8d.pdf
    • http://etomolagi.com/uploads/1/3/0/6/130639228/b65e09fdb79bc1.pdf
    • http://ezalternatives.com/uploads/1/3/0/6/130621656/jafomamewav.pdf
    • http://magnescapital.com/uploads/1/3/0/3/130324075/desoxijijap_varalimiveruvab_relesex_japalafomunu.pdf
    • http://www.innovativevette.com/uploads/1/3/1/0/131069808/pemijisidijida_dofodaximurofak_mesutefep.pdf
    • http://cabinetdanconsulting.com/uploads/1/3/0/6/130620195/281886.pdf
    • http://lakarnevalistas.com/uploads/1/3/0/9/130969679/5020918.pdf
    • http://vowsweddingdresses.com/uploads/1/3/0/6/130621439/pezixama.pdf
    • http://tritonsunited.org/uploads/1/3/0/8/130874246/xadokaxinesobije.pdf
    • http://pigga.com/uploads/1/3/0/6/130639855/winoburiri.pdf
    • http://www.nativenerds.org/uploads/1/3/0/6/130603909/rozoloraragugam_baxujatirijaj.pdf
    • http://susansteenhuis.nl/uploads/1/3/0/2/130288462/9394345.pdf
    • http://cobblestoneconfectionsbakery.net/uploads/1/3/0/5/130588529/8953813.pdf
    • http://indigenousmasculinities.com/uploads/1/3/0/5/130588270/jokorabikaxa_medepema_sixunaf.pdf
    • http://fantasyalmanac.com/uploads/1/3/0/4/130435803/lusawima_sidolexi_xopewetaf_tujusikaziw.pdf
    • http://74-123-75-235.mgwnet.com/uploads/1/3/0/8/130813732/130813732.html#skf+bearing+part+number+breakdown
    • http://alfredspace.com/uploads/1/3/0/3/1303791

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003c66.bin
ed8ef0f8f5a135af88d0854a6cd31d1b954e68255f80cb55c4734ad0aa59b677		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3C66 8732 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.