Malicious PDF — malware analysis report

Static analysis result for SHA-256 c8b2c7fddb7ccb18…

MALICIOUS

PDF

35.5 KB Authoring application: ImageMagick
MD5: 058c1f39f19cc566dbf17b3fe9f2e9a9 SHA-1: 970be3b77bdf3a3eb78ef23bedd2e6ca7ae67d58 SHA-256: c8b2c7fddb7ccb18ce0b1aa1b0a8c86b7258c4986e17c63eb903fb98b3630356
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded external links, as detected by the PDF_SEO_LINK_FARM heuristic. These links point to various domains, suggesting a link farm or a method to distribute malicious content. The ML classifier and ClamAV also flagged this file as malicious, with ClamAV identifying it as Pdf.Phishing.TtraffRobotInstall-7605656-0. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://postmaster.matcha-ya.com/uploads/1/3/0/5/130590545/toxinelikerawadak.pdf
    • http://theherbaceouscenter.com/uploads/1/3/0/3/130379218/zizoleko_porixidevi_suvakevezofele_sometadobi.pdf
    • http://cancercaremassage.co.uk/uploads/1/3/0/7/130776724/gatulus-ditumozude-wakusilajab.pdf
    • http://jomowlawncare.com/uploads/1/3/0/3/130312996/1247776.pdf
    • http://tillerenergypartners.com/uploads/1/3/0/4/130488243/1043526.pdf
    • http://www.b2excavatingllc.com/uploads/1/3/0/5/130543057/fb4f93d.pdf
    • http://masweetevents.com/uploads/1/3/0/6/130603979/970166.pdf
    • http://blog.psicologiaconstructiva.cl/uploads/1/3/0/5/130551925/1139172.pdf
    • http://www.phraseologychoir.com/uploads/1/3/0/5/130550818/8859068.pdf
    • http://nalacc.com/uploads/1/3/0/7/130739648/765bab1eddb3.pdf
    • http://www.susanjcurran.com/uploads/1/3/0/3/130379610/gunuwu_pobosadawivege_bafiz_terojoxosubudow.pdf
    • http://autodiscover.carpetcleaninghuntsville.com/uploads/1/3/0/2/130271207/641324.pdf
    • http://www.waterswindowcleaning.com/uploads/1/3/0/3/130313613/subixakafasoko.pdf
    • http://hostmaster.zauberer-romano.ch/uploads/1/3/0/7/130739416/vaguvuto.pdf
    • http://www.palmatutoring.com/uploads/1/3/0/4/130435839/tafiz.pdf
    • http://juntamugre.org/uploads/1/3/0/2/130271237/6537358.pdf
    • http://www.windows-defender.com/uploads/1/3/0/7/130739128/130739128.html#list+of+critically+endangered+species+2019
    • http://www.phraseologychoir.com/uploads/1

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002eb2.bin
d42cc11f0f8d7c80352779be26e36e66ed4968b2060ba1c9745bfbcd6765bfbb		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2EB2 7888 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.