Malicious PDF — malware analysis report

Static analysis result for SHA-256 b948d0fbb5637fe9…

MALICIOUS

PDF

40.2 KB Authoring application: Soda PDF
MD5: ccbf0b1d761d6682e8c7f4b62f61b1c0 SHA-1: 9106bfe930846e168f2310e3b33d3f8dff45f761 SHA-256: b948d0fbb5637fe98c1657e8c29f5d3eb6d7c53337d0a93e02ea93f0e07bdf26
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded external links, a technique often used for SEO spam or to direct users to malicious sites. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the ML classifier output strongly indicate malicious intent. The document body, though heavily obfuscated, contains references to 'Adobe acrobat pro full license price', suggesting a lure for software piracy or phishing. The primary attack pattern involves redirecting users to a vast array of linked PDF files hosted on various domains.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://louisvillepsychiatry.com/uploads/1/3/0/5/130588681/gutawekerixifezet.pdf
    • http://3828riverroadbricknj.com/uploads/1/3/0/7/130739170/giwepokub.pdf
    • http://androoms.net/uploads/1/3/0/4/130435826/9515859.pdf
    • http://www.thelipstickbandit.com/uploads/1/3/0/7/130776065/1048210.pdf
    • http://madcarn.com/uploads/1/3/0/3/130379357/1020044.pdf
    • http://voyager-balloons.com/uploads/1/3/0/3/130323311/54f20c53.pdf
    • http://fissuemail.com/uploads/1/3/0/6/130639734/lorofixuvosupeso.pdf
    • http://constructiondollarsandsense.net/uploads/1/3/0/6/130621794/xemomekovivi.pdf
    • http://shopgoodplant.com/uploads/1/3/0/2/130288486/karojufode.pdf
    • http://coffeeatyouroffice.com/uploads/1/3/0/5/130588796/dubamemuwonabel.pdf
    • http://ameskornerstore.com/uploads/1/3/0/6/130639720/gubisiwewive.pdf
    • http://corazondemujer.net/uploads/1/3/0/4/130435784/pukitade.pdf
    • http://bhpaschoolinspain.com/uploads/1/3/0/7/130739154/lukuxaz.pdf
    • http://mrmanateepoolservice.com/uploads/1/3/0/4/130483625/ronunep-kavixokosil.pdf
    • http://businessclaimingservice.com/uploads/1/3/0/6/130640070/gegofovizigu.pdf
    • http://mrsdawson-classroom.com/uploads/1/3/0/6/130604428/jilinuzomew.pdf
    • http://bulverdepregnancy.net/uploads/1/3/0/2/130272509/wutudupilerefasen.pdf
    • http://tristarlogos.com/uploads/1/3/0/7/130776099/kajarujel_vulirufa.pdf
    • http://missgojo.com/uploads/1/3/0/3/130323406/tupapoxe.pdf
    • http://nakomaplazaauto.com/uploads/1/3/0/4/130489006/29dc1b8b1a52.pdf
    • http://nickskitchendalycity.com/uploads/1/3/0/2/130288707/lovol.pdf
    • http://h4sd.com/uploads/1/3/0/8/130814360/finir.pdf
    • http://strmopus.com/uploads/1/3/0/8/130814021/6045698.pdf
    • http://mobilemassagenc.com/uploads/1/3/0/8/130874285/eddd27605c.pdf
    • http://squeezeapparel.com/uploads/1/3/0/3/130323552/3496842.pdf
    • http://www.hannahinstitute.org/uploads/1/3/0/6/130639491/130639491.html#adobe+acrobat+pro+full+license+price
    • http://mrsdawson-classroom.com/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000387c.bin
6dc4ad45a981c8a19695ebf3cce2822318e2cf43b3c6eb37c7d2ab4732a4686a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x387C 8192 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.