Malicious PDF — malware analysis report

Static analysis result for SHA-256 c08649e91022f9c6…

MALICIOUS

PDF

35.5 KB Authoring application: Adobe PDF Library 9.0
MD5: bdf056790546329f4b5a54ab65f87a4d SHA-1: 3ad2caeae8e510000d131cd12855de7226d7a520 SHA-256: c08649e91022f9c6a67195f9dbd3a5b79492fee8286860bae11e913f53948068
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded external links, a technique often used for SEO manipulation or to redirect users to malicious sites. The ClamAV detection and ML classifier strongly indicate malicious intent, consistent with a phishing or traffic-robotting scheme. No scripts were extracted, and the document body was heavily obfuscated, but the link farm is the primary indicator of malicious activity.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://emblemproject.com/uploads/1/3/0/6/130621588/vutukedorim_faluziwonulan.pdf
    • http://isabelreyna.com/uploads/1/3/0/6/130639161/bebaworonot.pdf
    • http://healergy.org/uploads/1/3/0/2/130273733/worobuz_lipukizovofe.pdf
    • http://tirerepairrichmond.com/uploads/1/3/0/2/130273850/4997696.pdf
    • http://mail.accessmudjimbashores.com/uploads/1/3/0/8/130813979/relozuxeverumu.pdf
    • http://androidue.com/uploads/1/3/0/5/130588842/sejoda.pdf
    • http://planettammy.com/uploads/1/3/0/8/130813855/majamop_ravujabal.pdf
    • http://www.muteki-shinkodenkai.pcamartialarts.com/uploads/1/3/0/5/130551491/kuranabosa.pdf
    • http://webdisk.downingtownswimacademy.com/uploads/1/3/0/5/130589391/beraxotajiloju.pdf
    • http://prdistributors.net/uploads/1/3/0/4/130489230/4175489.pdf
    • http://euterpe.ca/uploads/1/3/0/8/130813362/vagegulo.pdf
    • http://arduinista.org/uploads/1/3/0/6/130621989/litiji.pdf
    • http://www.waybeyondmusical.com/uploads/1/3/0/3/130379844/milajote.pdf
    • http://cleviagrandfullsite.devsite-1.com/uploads/1/3/0/4/130488451/130488451.html#coronary+ct+angio+cpt+code

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000033bc.bin
e21a8e85b584d128e1137e631b2b200ff7a349b3ad6632496214f740ae20831c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x33BC 7228 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.