Malicious PDF — malware analysis report

Static analysis result for SHA-256 d064c6d0eff64e86…

MALICIOUS

PDF

38.6 KB Authoring application: Nitro PDF
MD5: b539aa25fa1ebd89490879b6d19a4328 SHA-1: 8506c46550264a99b101f64667324034a6cc49b1 SHA-256: d064c6d0eff64e86f8e4d1b9fbdb5ef4299b53b3cfbd9aa5b29ff600b930a1b1
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded URLs, indicative of a link farm or phishing lure. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the ML classifier's high confidence score strongly suggest malicious intent. The primary attack pattern involves redirecting users to a network of external PDF documents, likely to host further malicious content or phishing pages.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://bethanyschooljat.org/uploads/1/3/0/2/130270934/mokakix_dopidafo_rabafawakez_viwazemevefo.pdf
    • http://norbertfodor.com/uploads/1/3/0/6/130640239/2271412.pdf
    • http://vipschoolofcosmetology.com/uploads/1/3/0/3/130313218/1019938.pdf
    • http://nomadicartist.org/uploads/1/3/0/2/130287285/edfc74.pdf
    • http://iamprovidence.net/uploads/1/3/0/4/130488979/e3c85841.pdf
    • http://ciarawiegers.com/uploads/1/3/0/6/130639224/683359.pdf
    • http://songhurstexperiment.com/uploads/1/3/0/5/130588858/c289de5ffdc6.pdf
    • http://seiterforjudge.com/uploads/1/3/0/6/130621857/ca3efba2.pdf
    • http://skywarnforum.com/uploads/1/3/0/3/130323774/4d70c.pdf
    • http://protectivearmour.com/uploads/1/3/0/5/130551050/galawunob.pdf
    • https://zuzeserotuxutur.weebly.com/uploads/1/3/0/5/130588370/707c0.pdf
    • http://millsupportzuid.com/uploads/1/3/0/4/130492771/tuniveb.pdf
    • http://colddiamnd.com/uploads/1/3/0/7/130740066/130740066.html#grief+and+loss+in+recovery+pdf

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000012db.bin
fd8c39000188b9d8f20d163bba120b42ec1b2372daf261ce668733436b76fd56		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12DB 8328 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.