Malicious PDF — malware analysis report

Static analysis result for SHA-256 ba1d4964d4363f1b…

MALICIOUS

PDF

34.6 KB Authoring application: SWFTools
MD5: b5fb17c6c92f56362fa9fdb620bbab77 SHA-1: 9ee8c361e61186d98b5fdee41d343cef6b02541f SHA-256: ba1d4964d4363f1bce3b6e6fe5c2796562f1b6f6f50cd9a04d8f2d357e5f8c0a
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF file contains a large number of embedded links to external PDF documents hosted on various domains. This behavior is indicative of SEO poisoning or a link farm designed to distribute malicious content or redirect users to phishing sites. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a phishing or traffic redirection motive.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://barrysatvadventures.com/uploads/1/3/0/5/130590384/953608ed6409.pdf
    • http://aeprilsarcana.com/uploads/1/3/0/5/130588640/4862470.pdf
    • http://obxaerialads.com/uploads/1/3/0/7/130739333/nufotokufegazanux.pdf
    • http://www.we4jesus.com/uploads/1/3/0/5/130589140/xifivobese.pdf
    • http://launchachurch.org/uploads/1/3/0/5/130538866/142442.pdf
    • http://clickfraudmanagement.com/uploads/1/3/0/2/130288514/176ffe7236.pdf
    • http://sheridan.technology/uploads/1/3/0/6/130604690/986173.pdf
    • http://theorlandorealtor.com/uploads/1/3/0/7/130776279/fatixuxujij.pdf
    • http://songarts.com/uploads/1/3/0/7/130738890/7a830f261ab104.pdf
    • http://gadgetgrump.com/uploads/1/3/0/5/130588501/tizopaxewejubag-barupo.pdf
    • http://trentriverdesigns.com/uploads/1/3/0/4/130476378/pivoxowazit_lodovanap_gasex_sojameg.pdf
    • http://74-123-73-55.mgwnet.com/uploads/1/3/0/3/130312920/130312920.html#deductive+and+inductive+reasoning+examples+in+everyday+life

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003155.bin
f097d185d537a28e98a610e8c9e66153180006969385491bd97a4bba7ae23e44		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3155 7448 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.