Malicious PDF — malware analysis report

Static analysis result for SHA-256 d7a670c6607bb727…

MALICIOUS

PDF

30.0 KB Authoring application: Mobipocket Creator
MD5: e548e25c97cef1d02686b0f4b98ec822 SHA-1: ff45cb86ed9a614cdf932a37497118ab4259ad6d SHA-256: d7a670c6607bb7277761ab5c832e13d6ab4a6c908854f603927fdc254edda885
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was flagged by multiple heuristics, including a critical PDF_SEO_LINK_FARM rule and ClamAV detection for 'Pdf.Phishing.TtraffRobotInstall-7605656-0'. The document contains a large number of embedded URLs pointing to external PDF files, suggesting a link farm or distribution mechanism. The ML classifier also strongly indicated maliciousness.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://wyomingvalleymedical.com/uploads/1/3/0/3/130313525/be6c78b1bae2ec.pdf
    • http://kalaman.net/uploads/1/3/0/4/130483983/gixukegotupe_buverij_pabalixe.pdf
    • http://methodalliance.org/uploads/1/3/0/2/130270911/tuwixomex_kufixawex.pdf
    • http://sepiat.one/uploads/1/3/0/7/130775921/wedumuvaf.pdf
    • http://essentialcleaning.vegas/uploads/1/3/0/4/130435737/785a4209.pdf
    • http://myfloridamediation.org/uploads/1/3/0/4/130476976/d636ac31.pdf
    • http://misskatskinks.com/uploads/1/3/0/5/130551187/nogasafadibadova.pdf
    • http://ddiamondco.com/uploads/1/3/0/4/130475989/worevugarigi-kevoj-biloziwa-kunirevuret.pdf
    • http://bbeboutiquellc.com/uploads/1/3/0/8/130814226/6951686.pdf
    • http://nokr.nl/uploads/1/3/0/3/130313671/130313671.html#plan+b+actions+speak+louder+than+words+lyrics
    • http://ncat.swe.org/uploads/1/3/0/4/130476607/afce07982503bec.pdf

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002317.bin
2e0ecb69fafd91cfc5e5e69fa7368cf3e9c782a0121ec0322a31d79b0a37a772		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2317 6488 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.