Malicious PDF — malware analysis report

Static analysis result for SHA-256 cde5f36ed1efc90e…

MALICIOUS

PDF

36.8 KB Authoring application: PDF Studio
MD5: 2632fff87d25de31179298de32c86222 SHA-1: ab4a4fb9699c3c5c213058f392969b5d0d6d5a1f SHA-256: cde5f36ed1efc90ef73466a7f32146db51d9b908983352023ffe7217e94b908f
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF file was flagged by multiple heuristics, including a critical PDF_SEO_LINK_FARM rule and ClamAV detection as Pdf.Phishing.TtraffRobotInstall. The presence of numerous external links, all pointing to PDF files on various domains, suggests a link farm or redirection scheme. The document body contains garbled text and a reference to 'cyclic vomiting syndrome treatment', which appears to be a lure. The primary attack pattern involves leveraging these links to potentially deliver further malicious content or phishing pages.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://dlolsonwoodworking.com/uploads/1/3/0/4/130476657/jototeki_pamewikiramil_vufapixobewebi_juvibus.pdf
    • http://www.codyjohn.net/uploads/1/3/0/7/130776266/ronikofen_vulesutuxelil_gakusapasag.pdf
    • http://donnezonline.com/uploads/1/3/0/5/130544751/ea60510b9319.pdf
    • http://tecdivehawaii.com/uploads/1/3/0/6/130603892/runawiv.pdf
    • http://negativetopositivefilms.com/uploads/1/3/0/6/130604874/1288803.pdf
    • http://i-cut.me/uploads/1/3/0/4/130483801/muzavejak.pdf
    • http://pressurewashingtorrance.com/uploads/1/3/0/7/130740375/6831131.pdf
    • http://mhdtechcorp.com/uploads/1/3/0/2/130287269/4671620.pdf
    • http://www.blconcretemichigan.com/uploads/1/3/0/6/130621344/gurane.pdf
    • http://atypical.film/uploads/1/3/0/2/130289386/sinonerewugofatudutu.pdf
    • http://internationalvoiceforyouth.org/uploads/1/3/0/2/130289246/5b3f85f.pdf
    • http://parallaxbrand.com/uploads/1/3/0/5/130539645/bekolatatativ-tuded-pazojok-morimu.pdf
    • http://petalstopins.com/uploads/1/3/0/4/130483576/witozifenozojidokox.pdf
    • http://tmlogisticsmx.com/uploads/1/3/0/3/130313087/3926603.pdf
    • http://oldwoostore.devsite-1.com/uploads/1/3/0/5/130544889/130544889.html#thc+cyclic+vomiting+syndrome+treatment

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000352c.bin
22fee6f8173a59a2c5be94b854438db9a7b17918167743bb77623d6a928d2f43		 pdf-font-stream PDF embedded font (sfnt) at offset 0x352C 8192 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.