Malicious PDF — malware analysis report

Static analysis result for SHA-256 d9b2dce6d4f8fb8a…

MALICIOUS

PDF

45.6 KB Authoring application: Solid Converter PDF
MD5: 1cb97c41e0b65e79df250ba069367a9f SHA-1: c955641c5167c79688258b24aac99d61d5059b1e SHA-256: d9b2dce6d4f8fb8a98d5b000cd5270b9d93962ee2ca4afac3df7703aa99e02fb
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of external links to other PDF files hosted on various domains, indicative of a link farm or SEO spam campaign. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the ML classifier output strongly suggest malicious intent. The embedded URLs are likely used to redirect users to malicious content or phishing sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://madisongrinnell.com/uploads/1/3/0/4/130435672/mubomifalademenud.pdf
    • http://www.pietrolesca.com/uploads/1/3/0/6/130603836/44d7bba.pdf
    • http://redguitarproductions.org/uploads/1/3/0/6/130620522/kewetofejor.pdf
    • http://www.thetravelauthority.com.au/uploads/1/3/0/9/130968937/fc34d0f82.pdf
    • http://ircventures.com/uploads/1/3/0/6/130640172/3242108.pdf
    • http://corbeauraceseat.com/uploads/1/3/0/8/130874110/gudukabozufolon_mesokaroretiku_sekan_rijomonazowifu.pdf
    • http://mydebtreliefteam.com/uploads/1/3/0/5/130551441/246dc6.pdf
    • http://brlandservicesinc.com/uploads/1/3/0/6/130603783/126012.pdf
    • http://www.kgsappliances.net/uploads/1/3/0/6/130621606/juvebokekit_vonej_mogiloxemiwap.pdf
    • http://dog-friendly.org/uploads/1/3/0/7/130739363/be2d86448.pdf
    • http://sbn.voyagerwebsites.com/uploads/1/3/0/5/130541402/130541402.html#helical+traveling-wave+tubes

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004eba.bin
479976567155bb1b501726a74cb87d96c216ec90485f40fb55202e02a18c60b9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4EBA 3260 bytes
font_01_sfnt_off00005c91.bin
83ea144a632c143c770729edf7a600011dd1a8436ed6f1d17233c81af4cf88bb		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5C91 8076 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.