Malicious PDF — malware analysis report

Static analysis result for SHA-256 adc6c9599b241807…

MALICIOUS

PDF

44.5 KB Authoring application: Inkscape
MD5: 2ea7601107743aac18fea42507645070 SHA-1: d6d6b2ab67467978b3e4a3da1322c7ac77394fe8 SHA-256: adc6c9599b2418071747bf36fbc292c762bc26d30bfcbef846726169b790012c
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded links to external PDF documents hosted on various domains. This behavior is indicative of a link farm or a distribution mechanism for further malicious content, as suggested by the 'PDF_SEO_LINK_FARM' heuristic and ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0'. The ML classifier also strongly flagged this file as malicious. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://wordpress-photography-themes.com/uploads/1/3/0/8/130813796/dixobogovipoli.pdf
    • http://southerntileinstallers.com/uploads/1/3/0/5/130544191/135e58a5d87c0d4.pdf
    • http://michelledrumheller.com/uploads/1/3/0/4/130476085/3eac24ad1c8f32.pdf
    • http://traverto.com/uploads/1/3/0/7/130776239/masowijat_memuroleragevod.pdf
    • http://adventuresinedtech.com/uploads/1/3/0/5/130538953/figaj.pdf
    • http://dnrdrywall.com/uploads/1/3/0/9/130969316/xasadu.pdf
    • http://twelvethirtyfourfilms.com/uploads/1/3/0/4/130489350/5478242.pdf
    • http://myfloridamediation.org/uploads/1/3/0/7/130740133/6815679.pdf
    • http://covernpages.com/uploads/1/3/0/4/130476978/7a03308dd6.pdf
    • http://150200martingale.com/uploads/1/3/0/5/130539344/folidi.pdf
    • http://jennycongrave.com/uploads/1/3/0/2/130273814/sabora_vukubu_xizubonoxifo_fugexapuzilib.pdf
    • http://poketrainer.club/uploads/1/3/0/4/130488829/daluzesisanu.pdf
    • http://theharrishawkinshometeam.com/uploads/1/3/0/7/130739878/4092062.pdf
    • http://us41marion.com/uploads/1/3/0/4/130489247/vikusipe.pdf
    • http://rickyzheng.net/uploads/1/3/0/5/130589010/6987457.pdf
    • http://www.iamchanging75.com/uploads/1/3/0/6/130604488/507128.pdf
    • http://ofa.sk/uploads/1/3/0/8/130813923/wupigun_dudibe_jebek_kolowenu.pdf
    • http://djmir.com/uploads/1/3/0/4/130435738/xedututobovi_tifukobal.pdf
    • http://www.ancienthand.net/uploads/1/3/0/6/130604388/jizobabiwukifer.pdf
    • http://thecountryovenbakery.com/uploads/1/3/0/4/130488569/nenotujopubevi.pdf
    • http://affordablewarbird.com/uploads/1/3/0/6/130604654/nosulaju.pdf
    • http://koches.design/uploads/1/3/0/5/130543207/2f5e15.pdf
    • http://robohobo.org/uploads/1/3/0/2/130287482/xuvurapesa-vojede-babugufi.pdf
    • http://seastar.websalve.com/uploads/1/3/0/9/130969200/130969200.html#blighted+ovum+two+yolk+sacs

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004ad3.bin
66fc8054427b2eab52a17afb85a639a194130e56b601351c89bf2008cc8a8fa5		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4AD3 8344 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.