Malicious PDF — malware analysis report

Static analysis result for SHA-256 bb3f64002c8ee979…

MALICIOUS

PDF

43.6 KB Authoring application: Adobe PDF Library 9.0
MD5: a42a2c00d0153cc308d49bac2337270c SHA-1: d95b29d217ab5c8264e925bcaaf411a708560e99 SHA-256: bb3f64002c8ee979e4064c2ab9ce99af782d7ace8df424e505486e405fe98aac
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded URLs, identified by the PDF_SEO_LINK_FARM heuristic, suggesting a link farm or phishing distribution mechanism. ClamAV detection as Pdf.Phishing.TtraffRobotInstall-7605656-0 further supports a phishing or malicious intent. The ML classifier also strongly indicated maliciousness. The embedded URLs are likely used to redirect users to malicious sites or download further payloads.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ecuoutlet.com/uploads/1/3/0/6/130604427/9496920.pdf
    • http://togetheras3pointone.com/uploads/1/3/0/6/130621152/6131b94e.pdf
    • http://mobilsistemicg.me/uploads/1/3/0/4/130477455/4907507.pdf
    • http://gokarbon.org/uploads/1/3/0/7/130775018/1047994.pdf
    • http://digital-aun.com/uploads/1/3/0/8/130813779/0441677.pdf
    • http://madcarn.com/uploads/1/3/0/6/130640190/mujewibagelav_xatisit_sukuwujutelapi.pdf
    • http://michaelsautodetailing.com/uploads/1/3/0/5/130588773/8d473cd08b8a46d.pdf
    • http://kayleighpeddie.com/uploads/1/3/0/2/130270746/pimesoliwuxin_lagibexoniv_xojewe_fuvizixabuga.pdf
    • http://midwestalehouse.com/uploads/1/3/0/6/130621333/rufivodilejopovenom.pdf
    • http://axlecreek.net/uploads/1/3/0/2/130274319/vezewibakarew-vuluju-nitamizivaxa-disusinarev.pdf
    • http://pelosophotography-yearbooks.com/uploads/1/3/0/5/130543979/23423d0ee12.pdf
    • http://nrv-ayurveda-foundation.org/uploads/1/3/0/6/130620567/bupabedepat-dojekidot.pdf
    • http://pensionsonline.info/uploads/1/3/0/6/130604227/3b714cdf.pdf
    • http://cpanel.kingfishercct.org/uploads/1/3/0/5/130590678/922e44209b8e.pdf
    • http://mifitnesslife.com.au/uploads/1/3/0/7/130739991/653724.pdf
    • http://thequiltstudio.com/uploads/1/3/0/7/130776042/d8206a6401bf.pdf
    • http://www.boxpact.com/uploads/1/3/0/4/130490609/zemonupasoboparis.pdf
    • http://desatascosmartorell.net/uploads/1/3/0/5/130543107/nemuj_dimer_dotij_lamiva.pdf
    • http://newrichmondoh.org/uploads/1/3/0/7/130740264/dezarawozefisi.pdf
    • http://herbalhealingformulacream.com/uploads/1/3/0/5/130588430/7956194.pdf
    • http://bvhstyle.com/uploads/1/3/0/3/130379219/3896532.pdf
    • http://cloud.sentinel-air.com/uploads/1/3/0/6/130639882/130639882.html#ecological+footprint+non+examples
    • http://ecuoutlet.com/uploads/1/3/0/6/130604427/94

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004b91.bin
9f3be09b2b80ca5c7fcc38b6a70dc57c2fab93c59d86cbcc76cd7cc1352194ed		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4B91 7400 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.