Malicious PDF — malware analysis report

Static analysis result for SHA-256 ce418c4980bf9125…

MALICIOUS

PDF

46.9 KB Authoring application: ImageMagick
MD5: 2847b44868f04d49dd916f1ca569d31a SHA-1: 9e70c0c113c3f392e41991f0f9f122ec010f23f7 SHA-256: ce418c4980bf9125893492802bb8496d32143bcf567a2ec70596383c0f01ccbb
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of external links, many of which point to suspicious domains, indicating a link farm for phishing or malware distribution. ClamAV identified the file as 'Pdf.Phishing.TtraffRobotInstall-7605656-0', and ML classification strongly supports maliciousness. The document body, though heavily obfuscated, contains URLs that are also listed in the extracted URLs section, reinforcing the phishing lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9971

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://tizenak.tdorestoran.ru/uploads/2020/01/28/mitobaluxuwop.pdf
    • http://1st-plumbing.com/uploads/1/3/0/6/130621915/9766292.pdf
    • http://barclaysme.com/uploads/1/3/0/3/130313000/zumiz-nekelosujibow-dimifakoxoze.pdf
    • https://fokuviniwa.weebly.com/uploads/1/3/0/2/130289765/f23ae2260410a2.pdf
    • http://ogo.best/uploads/2020/01/29/kufefuz-momoxarel.pdf
    • http://cassienormandy.weebly.com/uploads/1/3/0/6/130604547/130604547.html#advertising+and+sales+promotion+management+pdf

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001270.bin
a0479b3389f9b1478ab1ab857336c6dc634ea81066dc0152c00665d9c1d92bcf		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1270 8084 bytes
font_01_sfnt_off000051c2.bin
da097a8c459adbfdf1b1d97412e41569b305acf822c6e113ff3e46e38a168572		 pdf-font-stream PDF embedded font (sfnt) at offset 0x51C2 16224 bytes
font_02_sfnt_off00006699.bin
236d54f3e2479d5e72da3d1be4616617e509581c3e9108e812f40a19f40d28ff		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6699 2228 bytes
font_03_sfnt_off000070aa.bin
a13650c4fc9a1197943f4ef8f7c6b276ca998e723c1a1d30187c3905042290bf		 pdf-font-stream PDF embedded font (sfnt) at offset 0x70AA 7976 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.