Malicious PDF — malware analysis report

Static analysis result for SHA-256 af2337702f49ce89…

MALICIOUS

PDF

46.6 KB Authoring application: QPDF
MD5: 0c95e96bca6735944402fd5aad70d849 SHA-1: 7685c01358846b1120d3240eecc0619b8137409c SHA-256: af2337702f49ce89659b97b68ce7df2b133ee6379b14b129bff70e2a6b95a47b
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of external links, many of which point to other PDF files hosted on various domains, indicating a link farm for SEO or malicious redirection. ClamAV identified the file as Pdf.Phishing.TtraffRobotInstall-7605656-0, and a machine learning classifier also flagged it as malicious. The document body, though heavily obfuscated, contains references to software and URLs, suggesting a lure to download further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://neroliltd.com/uploads/1/3/0/7/130740492/9fd73e453b7fb.pdf
    • http://sarahrileypottery.com/uploads/1/3/0/4/130493714/nezisolusu-japipape.pdf
    • http://missmillersclassroom.com/uploads/1/3/0/5/130545254/nusobe.pdf
    • http://premierbeachpropertymanagement.com/uploads/1/3/0/4/130483477/ad44f622558.pdf
    • http://courageblogs.com/uploads/1/3/0/6/130604363/3791578.pdf
    • https://nivelimobe.weebly.com/uploads/1/3/0/3/130313612/zubepe.pdf
    • http://mikeintucson.com/uploads/1/3/0/4/130491179/130491179.html#bartender+barcode+full

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000010fb.bin
9276ae18d6a236dee1e981b5b172de1fd072ad0f13dcb348480ba1821fe8366d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10FB 8708 bytes
font_01_sfnt_off000064ee.bin
89cffd49cf4750360b48b4fe2269b7dba9def12e76d8034fb78fc8b51d0e4c24		 pdf-font-stream PDF embedded font (sfnt) at offset 0x64EE 14440 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.