Malicious PDF — malware analysis report

Static analysis result for SHA-256 cb8ce180019d9c08…

MALICIOUS

PDF

40.6 KB Authoring application: SWFTools
MD5: 1801018da8cc72bd6b1b401eeec7be6a SHA-1: 724f9201f28bfe559b762520fac076affe3f4937 SHA-256: cb8ce180019d9c08544e267ed0158ed6f18a052e90b68834085be9172d8dcabf
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF file was flagged by multiple heuristics, including a critical PDF_SEO_LINK_FARM rule and ClamAV detection for Pdf.Phishing.TtraffRobotInstall-7605656-0. The ML classifier also assigned a high probability of maliciousness. The primary attack pattern involves a large number of embedded external links pointing to PDF files on various domains, suggesting a link farm or distribution network. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ninjaprite.com/uploads/1/3/0/7/130738719/todusekewule.pdf
    • http://sunges.net/uploads/1/3/0/7/130740427/2698567.pdf
    • http://nightshadecollective.com/uploads/1/3/0/6/130620354/nonizu.pdf
    • http://evilgamers.com/uploads/1/3/0/6/130603798/zefigori.pdf
    • http://knowledgelord.com/uploads/1/3/0/4/130435503/gemasom-gomanibumim-nexitejur-pewokolozaxuj.pdf
    • http://suekodress.com/uploads/1/3/0/7/130776331/5701196.pdf
    • http://jet4plugins.net/uploads/1/3/0/3/130323253/kokoxen.pdf
    • http://artmat.net/uploads/1/3/0/6/130640025/69583794d57b.pdf
    • http://npzchs.site/uploads/1/3/0/6/130604687/9be61.pdf
    • http://nursesnowinc.org/uploads/1/3/0/6/130639115/zufalibele.pdf
    • http://madeinvenice.net/uploads/1/3/0/4/130435644/1302696.pdf
    • http://daviddegennaro.com/uploads/1/3/0/4/130435531/ruwen.pdf
    • http://saudeadulta.com/uploads/1/3/0/5/130551597/tedada.pdf
    • http://dollarstore-plus.com/uploads/1/3/0/6/130621606/famunoxova.pdf
    • http://mermaidfitnessbump.com/uploads/1/3/0/7/130776111/7669460.pdf
    • http://emilytiberio.com/uploads/1/3/0/8/130813649/binapisopefiwim-wazalofaw-buxezuronizipi.pdf
    • http://p4partyproductions.com/uploads/1/3/0/5/130550928/b635022975ae.pdf
    • http://mk-acupuncture.com/uploads/1/3/0/8/130874516/pujaru_wewugiporurufir_dogaxa.pdf
    • http://onlocationvacations.net/uploads/1/3/0/4/130488252/fimom.pdf
    • http://deadlygraphix.com/uploads/1/3/0/5/130548039/4e7aca21.pdf
    • http://curiousconversations.org/uploads/1/3/0/5/130541443/wodenefeposesad.pdf
    • http://immediateinsight.com/uploads/1/3/0/3/130323603/2706599.pdf
    • http://treinasoft.net/uploads/1/3/0/3/130312984/bdaf2.pdf
    • http://minimebodysculpting.com/uploads/1/3/0/7/130776720/5df7fe3.pdf
    • http://niftyninniescleaning.com/uploads/1/3/0/7/130776197/5684671.pdf
    • http://a1360813xstreamtravel.xsideas.com/uploads/1/3/0/6/130620955/130620955.html#gta+san+andreas+cheats+ps2+spawn+cars
    • http://madeinvenice.net/uploads/1/3/0/4/130435644

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003920.bin
a9f67c5df1c92d0408878d53b3a61c4301449393ab5a575656ac1959a5658ad0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3920 8400 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.