Malicious PDF — malware analysis report

Static analysis result for SHA-256 ac6f444fae331e55…

MALICIOUS

PDF

37.4 KB Authoring application: pstoedit
MD5: 1a39a0e2e1350a2854003622b56c1cf0 SHA-1: d4fc81102bb944beb9b912c86199f909d31d955f SHA-256: ac6f444fae331e5527b7aa63bbb568a5f6e5aee1a370a752fd226c30c3db2254
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF file was flagged by multiple heuristics, including a critical finding for a 'PDF_SEO_LINK_FARM' and a ClamAV detection for 'Pdf.Phishing.TtraffRobotInstall-7605656-0'. The ML classifier also assigned a high probability of maliciousness. The document body contains numerous external URLs, suggesting a phishing or SEO spam campaign. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://derekhoshiko.com/uploads/1/3/0/4/130436202/pizusorusu_bitaxised.pdf
    • http://trondekyouthservices.com/uploads/1/3/0/6/130604446/cb49823f1.pdf
    • http://eandjtile.com/uploads/1/3/0/8/130874009/sawutupisanefusijike.pdf
    • http://tuknikgs.com/uploads/1/3/0/4/130477234/tawapopivamaxo.pdf
    • http://cotic.com.hr/uploads/1/3/0/7/130740013/pujobovotivelujemi.pdf
    • http://southtacomamassage.com/uploads/1/3/0/5/130543985/desozis.pdf
    • http://wanderboss.com/uploads/1/3/0/5/130540477/gewajazixixukajabak.pdf
    • http://malokuhome.net/uploads/1/3/0/5/130551181/1702198.pdf
    • http://organicbundle.com/uploads/1/3/0/7/130738569/takataxilanivozop.pdf
    • http://yooperdesignz.com/uploads/1/3/0/5/130589316/3e1ee32891.pdf
    • http://mounthebronstem.com/uploads/1/3/0/5/130551434/barovofepovolaxemeb.pdf
    • http://asociacioncristianabiblicaporextensiondenicaragua.com/uploads/1/3/0/2/130287246/6143879.pdf
    • http://seasoil.net/uploads/1/3/0/5/130551991/2952704.pdf
    • http://355cochrane.com/uploads/1/3/0/7/130775846/10c75f0f479dea.pdf
    • http://becauseprosknow.com/uploads/1/3/0/4/130476276/gidob.pdf
    • http://autodiscover.thankfulrecords.com/uploads/1/3/0/4/130476722/delesebojotag_dugib_faxipupabasabus_dobuzotofep.pdf
    • http://madeinvenice.net/uploads/1/3/0/6/130605017/8ce17845d1.pdf
    • http://midnighttokerstore.com/uploads/1/3/0/2/130289189/wuredigujisip_rasibufodowop.pdf
    • http://www.thememo.ca/uploads/1/3/0/3/130379243/5482016.pdf
    • http://anaeugeniophotography.org/uploads/1/3/0/5/130588618/6535867.pdf
    • http://thestockmarketrecap.net/uploads/1/3/0/2/130270790/powoduluforubud.pdf
    • http://www.samlief.com/uploads/1/3/0/6/130639052/fetev.pdf
    • http://hardhathomeinspection.com/uploads/1/3/0/5/130590312/130590312.html#business+english+idioms+exercises+pdf

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003093.bin
5ac332fc6a36c6cba08221483eb2c7c5bba4c180545f3dfe33e3717a03feb8d4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3093 7972 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.