Malicious PDF — malware analysis report

Static analysis result for SHA-256 acc22d236fa8a7b9…

MALICIOUS

PDF

32.4 KB Authoring application: PDF Studio
MD5: df1f0fa533f281736c7c2a1b727891ab SHA-1: 12233c7a91a82d88a4a8672b9299a45fa5a99ac2 SHA-256: acc22d236fa8a7b97eccc5ea735d9ae8967af0061570ea8f70981f26243c6a39
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded URLs pointing to external PDF files, a technique commonly used for SEO poisoning or phishing. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the ML classifier output strongly indicate malicious intent. The embedded URLs likely serve as a lure to redirect users to malicious content or further phishing pages.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://mycryosculpt.com/uploads/1/3/0/2/130288348/1112024.pdf
    • http://nedhee.com/uploads/1/3/0/5/130552016/628852.pdf
    • http://cambiatucasa.com/uploads/1/3/0/4/130476263/jedejarupojom-kunafuluvilela-xufexaju-nejivumabepafe.pdf
    • http://royaltrainridesrentals.com/uploads/1/3/0/7/130740256/wogapofinuzizuwinu.pdf
    • http://etherialengine.com/uploads/1/3/0/6/130604597/1ad56d38f7caefd.pdf
    • http://fhloston-paradise.com/uploads/1/3/0/5/130539419/cccef65367.pdf
    • http://nandaphoto.com/uploads/1/3/0/5/130547812/086cdf1.pdf
    • http://www.chilhowiechristianchurch.com/uploads/1/3/0/4/130483305/wafisozuzevusozi.pdf
    • http://mindfulengagment.com/uploads/1/3/0/4/130476672/nibefasu_tetifoxafoju_dafivuwojuwe.pdf
    • http://aaroncharlesg.com/uploads/1/3/0/5/130539319/054f2f0.pdf
    • http://rspmadison.org/uploads/1/3/0/8/130873876/fabuxar_lixixagu.pdf
    • http://fitshareonline.com/uploads/1/3/0/6/130605447/1365398.pdf
    • http://securesanitation.net/uploads/1/3/0/8/130874063/2378919.pdf
    • http://surajdhakal.com/uploads/1/3/0/3/130323186/690572.pdf
    • http://www.miriamterron-elder.com/uploads/1/3/0/6/130604644/mixokipaninol.pdf
    • http://host197.carmichaelnl.com/uploads/1/3/0/6/130621032/130621032.html#kuta+software+infinite+algebra+2+absolute+value+inequalities+with+work
    • http://www.miriamterron-elder.com/uploads/1/3/0/6/130604644/mixokipaninol

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000247a.bin
56e6fcb897e4bf3c5dc8658f117e59ca51696c43da2dcdad5585ffc1a0f094f0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x247A 7544 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.