Malicious PDF — malware analysis report

Static analysis result for SHA-256 c5c4f68cd3d1844d…

MALICIOUS

PDF

36.2 KB Authoring application: PDFedit
MD5: 20b937602f82290c45a6ecbccf3d3d61 SHA-1: e40e85bf220353221237b5bde8f4742269a876b2 SHA-256: c5c4f68cd3d1844d81ac9c4336c90fd4d04ced0181865965051ecc7ff9e7688a
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded URLs pointing to other PDF files, a technique often used for SEO manipulation or to distribute malware. ClamAV identified this as 'Pdf.Phishing.TtraffRobotInstall-7605656-0', and a critical heuristic detected a PDF link farm. The ML classifier also strongly indicated maliciousness. No scripts were extracted, limiting the ability to determine specific payload delivery mechanisms.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://nicoleandbarry.us/uploads/1/3/0/5/130590392/7227277.pdf
    • http://captain-teapot.com/uploads/1/3/0/4/130478438/diwadarowoxuwev.pdf
    • http://animalandiagta.com/uploads/1/3/0/8/130814187/2675171.pdf
    • http://nerdfinance.net/uploads/1/3/0/5/130546497/texufilinasot.pdf
    • http://alexvasiliu.com/uploads/1/3/0/3/130323585/tupawikaxasopi-xamiwejes-morepakezik.pdf
    • http://daveparkerlive.com/uploads/1/3/0/7/130775129/zimubebefaseko.pdf
    • http://replicontainer.com/uploads/1/3/0/4/130489228/7309047.pdf
    • http://btmamusic.com/uploads/1/3/0/8/130813054/21340.pdf
    • http://www.chitraleka.co.uk/uploads/1/3/0/8/130813592/faecd87629813.pdf
    • http://midnightepiphanymusic.net/uploads/1/3/0/4/130435551/fasovewo.pdf
    • http://fandomaf.com/uploads/1/3/0/2/130270994/527c7e220d7.pdf
    • http://getawaymiles.com/uploads/1/3/0/3/130379158/d8dbca4d9dcc12f.pdf
    • http://liberty-rc.com/uploads/1/3/0/4/130489128/970cd1f38b239b3.pdf
    • http://sstvipgroup.com/uploads/1/3/0/7/130775865/9616039.pdf
    • http://eastcoastspirituals.com/uploads/1/3/0/2/130271190/damejugokifi-rixelovu-dixelasimoboz.pdf
    • http://iterodentallaboratory.com/uploads/1/3/0/6/130621789/lolasarowasib.pdf
    • http://www.eigojoy.com/uploads/1/3/0/5/130543210/e96c0c3982.pdf
    • http://521.bpmtc.com/uploads/1/3/0/9/130969854/130969854.html#hand+exercises+to+do+after+carpal+tunnel+surgery

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003256.bin
39eaa8f2fade056c26ea8f5bceb18ea87665c33c79b8bbf89a6ee7bfd65b6c58		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3256 7456 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.