Malicious PDF — malware analysis report

Static analysis result for SHA-256 b6d67de06224a1b6…

MALICIOUS

PDF

37.5 KB Authoring application: GIMP
MD5: b0f6cb16b339f3a71ab7517d393fb5e6 SHA-1: ead74fd700fd546c4cd10cadb7e8f293cc4163a6 SHA-256: b6d67de06224a1b602c935e4209d957fc49bf8bededf7718fc065b166f8a6bba
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded URLs pointing to other PDF files, a technique often used for SEO spam or to distribute malicious content. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the ML classifier strongly indicate malicious intent. The primary attack pattern involves redirecting users to a network of external PDF documents, likely to host further malicious payloads or phishing content.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.pogadajmy.org/uploads/1/3/0/3/130313590/wopulon.pdf
    • http://jaynegirl.ca/uploads/1/3/0/5/130550764/8f545760.pdf
    • http://didsburysmiles.com/uploads/1/3/0/7/130740264/6845358.pdf
    • http://kootenaycured.com/uploads/1/3/0/4/130435743/2796863.pdf
    • http://blubloggs.com/uploads/1/3/0/4/130488698/ec5a77dafc495.pdf
    • http://icecreamstones.org/uploads/1/3/0/8/130874526/52ee6050.pdf
    • http://mindbodymend.com.au/uploads/1/3/0/6/130620267/4d5a18da.pdf
    • http://nkbcapital.com/uploads/1/3/0/4/130476970/5047799.pdf
    • http://mysteretro.com/uploads/1/3/0/5/130590477/48de8eec572f.pdf
    • http://midwestairsoftgroup.net/uploads/1/3/0/7/130776279/4836454.pdf
    • http://minocquasurf.com/uploads/1/3/0/4/130489019/4f108473373.pdf
    • http://iteroimplant.com/uploads/1/3/0/3/130379115/47e2148c5c0.pdf
    • http://weekeepcompany.com/uploads/1/3/0/4/130483329/1160317.pdf
    • http://tampalandscapedesign.com/uploads/1/3/0/4/130483513/4683199.pdf
    • http://carriehohmann.com/uploads/1/3/0/5/130543029/8941719.pdf
    • http://makercenterusa.com/uploads/1/3/0/6/130639126/sukil-sonomotodet-gamopebub-galatawozitu.pdf
    • http://firezoneschaumburg.com/uploads/1/3/0/6/130604580/fadokuvoxiwemejimu.pdf
    • http://miracostamun.com/uploads/1/3/0/5/130589179/7988028.pdf
    • http://mitefnw.org/uploads/1/3/0/3/130313459/563976f2b80ffe.pdf
    • http://mail.newzionshilohs.org/uploads/1/3/0/4/130483847/c2f6a78d8c96c.pdf
    • http://malmo2020.se/uploads/1/3/0/8/130814643/ruzuzeputiwumuvuxesa.pdf
    • http://roguestarmedia.com/uploads/1/3/0/6/130604133/bd407650a.pdf
    • http://handsunitedundergod.org/uploads/1/3/0/2/130289592/vorevupano_jabofarubafewof_mesabizadiban.pdf
    • http://klokkeraadgivning.com/uploads/1/3/0/5/130539279/130539279.html#lesson+8-3+reteach+adding+and+subtracting+rational+expressions
    • http://handsunitedundergod.org/uploads/1/3/0/2/130289592/vorevupano_jabofarubafewof

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002f37.bin
c6e1744670c2553d562c96f42880fc8b8b47d94f2f589325ba8f1ba40159fbab		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2F37 8308 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.