Malicious PDF — malware analysis report

Static analysis result for SHA-256 b71c21d1aa041ae6…

MALICIOUS

PDF

57.2 KB Authoring application: pdf-parser
MD5: 9d22d9f68e4605adef42c67f3bc5f384 SHA-1: b258146124d1c55126de4b78e58f3af91da6b1dc SHA-256: b71c21d1aa041ae6c7c6cbb9915d4c1723578d442417ff6db895279cb6cd5605
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded links to external PDF documents, a technique often used for SEO manipulation or to distribute malicious content. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the ML classifier output strongly indicate malicious intent. The embedded URLs are the primary indicators of compromise, suggesting a campaign to drive traffic to these linked resources.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://feinerfreitag.ch/uploads/1/3/0/6/130621744/jenoben.pdf
    • http://thejuiceunion.com/uploads/1/3/0/2/130272266/ada3d500d.pdf
    • http://poachingfaqs.com/uploads/1/3/0/4/130488970/61aa0acc0f4accb.pdf
    • http://ms-j.org/uploads/1/3/0/2/130289327/gavijitaxesajo.pdf
    • http://fidospantry.org/uploads/1/3/0/5/130588681/gaximezedo.pdf
    • http://balkanco.com/uploads/1/3/0/3/130324027/dufofafonebi.pdf
    • http://playpass.net/uploads/1/3/0/6/130604414/faxuvexoji.pdf
    • http://pipestoneresearch.com/uploads/1/3/0/5/130588288/kunimafewegan.pdf
    • http://crystalwittenutrition.com/uploads/1/3/0/6/130605505/f73782a6.pdf
    • http://earthspiritpress.com/uploads/1/3/0/5/130590555/vifalu_sivil_moxaxa_kobor.pdf
    • http://nationalautomobilemuseum.org/uploads/1/3/0/4/130490774/dobefizukut-nabikegozo-loletitib.pdf
    • http://northjerseydirectmail.com/uploads/1/3/0/5/130550774/jikegokijiwetadawot.pdf
    • http://apartmentsinbuffalony.com/uploads/1/3/0/8/130814106/5679382.pdf
    • http://sunshynephoto.com/uploads/1/3/0/7/130776222/kudijot-sotetoze.pdf
    • http://floridagungear.com/uploads/1/3/0/2/130287296/ravimategumifi.pdf
    • http://jenniferstimsonnutrition.com/uploads/1/3/0/6/130639895/130639895.html#land+of+the+rising+sun+ielts+answers

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00000ef6.bin
884671249c933c301a7236ca50da1593a4c658debc5e6754d77fa0a7f1b9cea9		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEF6 8348 bytes
font_01_sfnt_off00008d44.bin
5a9695438bb362a8b10d86f415c06da9d71f416851af8c6c9c762304ce3c8158		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8D44 16088 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.