Malicious PDF — malware analysis report

Static analysis result for SHA-256 c2691325bbd07559…

MALICIOUS

PDF

38.2 KB Authoring application: ImageMagick
MD5: 3973e2537df3640bed4e3c56291afcc5 SHA-1: aed497c47fd606809dfb12a9821fe3e59e103c80 SHA-256: c2691325bbd07559e407e0a9e3d2e1dc09263907886df164993ba413b3680dc5
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic, suggesting a link farm or phishing lure. ClamAV detection as Pdf.Phishing.TtraffRobotInstall-7605656-0 further supports a phishing or malicious redirection intent. The embedded URLs are likely used to redirect users to malicious content or phishing pages.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://delbertsonrealty.com/uploads/1/3/0/6/130603890/wesagi.pdf
    • http://my.trssociety.ca/uploads/1/3/0/5/130540926/narifufukapat.pdf
    • http://bnbgourou.net/uploads/1/3/0/4/130488331/sabumipefabitiv.pdf
    • http://counterboycott.org/uploads/1/3/0/6/130622042/jovomofe.pdf
    • http://rivalrygraphics.com/uploads/1/3/0/8/130873921/bajolifisitazod-nobowowazox-dogudelefalu-sowijirogisara.pdf
    • http://dmgatl.com/uploads/1/3/0/2/130287929/268c0bf489c8a.pdf
    • http://nationalrpoclinic.com/uploads/1/3/0/8/130814706/97281317661bd.pdf
    • http://tryshashby-rolls.com/uploads/1/3/0/7/130739878/webowut.pdf
    • http://gmtenniscenter.com/uploads/1/3/0/6/130604530/7af273e5f53.pdf
    • http://rededemidias.net/uploads/1/3/0/7/130740074/084470bea.pdf
    • http://pentejoy.com/uploads/1/3/0/6/130604394/manamixofeluji.pdf
    • http://netspeedsolutions.com/uploads/1/3/0/2/130274269/2154035.pdf
    • http://copperpotcreative.com/uploads/1/3/0/7/130739011/9154436.pdf
    • http://returningtocompassion.org/uploads/1/3/0/4/130488172/bezit_laxifubozati.pdf
    • http://london-office-3.pleasingfood.com/uploads/1/3/0/2/130287871/130287871.html#esc+atrial+fibrillation+guideline
    • http://returningtocompassion.org/uploads/1/3

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003b24.bin
7f61eb32ef98ae876f9affb03e187f1ac8e2e383a8e5c991cecee7e1e594ff60		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3B24 8140 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.