Malicious PDF — malware analysis report

Static analysis result for SHA-256 bee014910d71fc97…

MALICIOUS

PDF

37.7 KB Authoring application: Nitro PDF
MD5: 090bcfc8c71af04c3dd5ccf431a0ca95 SHA-1: 7ea23e1490b4f176b7b45bdebe9d63fd18ab9f9f SHA-256: bee014910d71fc973fce2a5ffc82e346230fa09aee729d924ab987aa25dc9e8c
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded links to external PDF files, indicating a link farm or redirection scheme. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the ML classifier's high confidence score further support a malicious intent. The document body appears to be malformed or truncated, preventing a more detailed analysis of its specific lure.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.subbystreeserviceandlandscaping.com/uploads/1/3/0/8/130813966/bujaze_purebuverakakux_majizezosumar_kafitazomudori.pdf
    • http://migrantliteraturejournal.com/uploads/1/3/0/2/130272350/8730586.pdf
    • http://restaurant.nomadsadventurequest.com/uploads/1/3/0/5/130539403/dimakudarena.pdf
    • http://negociofuxion.com/uploads/1/3/0/3/130379561/garipebosomef.pdf
    • http://coastnuflow.com.au/uploads/1/3/0/5/130550833/zejotowi.pdf
    • http://northpointed.com/uploads/1/3/0/5/130544190/371369.pdf
    • http://andrealarson.com/uploads/1/3/0/6/130621905/ec4b380.pdf
    • http://engagebuilding.com/uploads/1/3/0/8/130874235/2379fbfda3c.pdf
    • http://www.hphotographic.co.uk/uploads/1/3/0/8/130813403/8442023.pdf
    • http://gaborbach.com/uploads/1/3/0/8/130814258/9e0b34016b5.pdf
    • http://finaltouchcleaningservices.net/uploads/1/3/0/5/130551073/a4503f4.pdf
    • http://mrorejel.info/uploads/1/3/0/2/130288307/e3cde0411.pdf
    • http://peace-walk.com/uploads/1/3/0/5/130541103/113797.pdf
    • http://www.homestylechildcareandpreschool.com/uploads/1/3/0/8/130814871/gunip-wozogako-fanolemew.pdf
    • http://nichellerenee.solutions/uploads/1/3/0/2/130291800/2217174.pdf
    • http://choseniii.com/uploads/1/3/0/8/130813366/lopokisefoniwu-moduj-zovokavibo.pdf
    • http://capecoralmasoniclodge367.com/uploads/1/3/0/6/130622063/warewipusesusumin.pdf
    • http://ultradeepfieldmusic.com/uploads/1/3/0/6/130620729/7636470.pdf
    • http://adventuresinedtech.com/uploads/1/3/0/6/130621490/4563757.pdf
    • http://ddct-24-4-crs-4g-100m.pleasingfood.com/uploads/1/3/0/6/130639251/130639251.html#ikea+emeryville+hours+saturday
    • http://peace-walk.com/uploads/1/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000033c5.bin
aceda2069a034b62693bbff655cb4f33b2882edb8989a7690b9e123f5f1a05f2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x33C5 8452 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.