Malicious PDF — malware analysis report

Static analysis result for SHA-256 d9cb99f044e80cf6…

MALICIOUS

PDF

54.0 KB Authoring application: Poppler-utils
MD5: cdfd46ad205c327a146245ceda3c47f8 SHA-1: 08ae1aea9e98bcb3538b91d25a5146e5eef5d9c8 SHA-256: d9cb99f044e80cf60dcd7885bdc0466b9c4b1d6cc942fbf5aa177cb52e9b73bc
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded external links, identified as a link farm. This technique is often used to manipulate search engine rankings or to redirect users to malicious websites. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a phishing or traffic-driving intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://holycowchocolate.com/uploads/1/3/0/3/130313368/rireloritupadafozobo.pdf
    • http://davisionfilms.com/uploads/1/3/0/6/130621488/1da7826b174.pdf
    • http://pinkysgotpurses.com/uploads/1/3/0/7/130739567/desafa_seniliruginuwow.pdf
    • http://nomnomgelato.com.au/uploads/1/3/0/5/130546880/61720bcb75db.pdf
    • http://milescan.com/uploads/1/3/0/6/130604543/6b76946b28.pdf
    • http://billelenbark.net/uploads/1/3/0/6/130621057/dutape.pdf
    • http://cynicalpicnic.com/uploads/1/3/0/3/130324137/2118105.pdf
    • http://waea.net/uploads/1/3/0/3/130379146/40dde320b04d.pdf
    • http://mrsrashid.com/uploads/1/3/0/5/130539757/sepenututowuxavabifa.pdf
    • http://phillywaxing.com/uploads/1/3/0/5/130590374/gironajozimebunuz.pdf
    • http://detailpoint.nl/uploads/1/3/0/2/130272937/mamuxipixozezababo.pdf
    • http://moir.se/uploads/1/3/0/6/130604486/eecd5a27653.pdf
    • http://acouturelife.com/uploads/1/3/0/4/130479210/130479210.html#bleacher+report+week+8+fantasy+football+rankings

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000134b.bin
4c663c9d7819e8a66689773ffa2346e305cafe8e20bba42e0fcd7de0155926b4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x134B 8796 bytes
font_01_sfnt_off00008283.bin
ef16810021e0f51ad518176571e1abf7ee1dfdb2484f5d40e6061b602b871e5a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8283 16356 bytes
font_02_sfnt_off000097f4.bin
8ec8c2252d1b0a1cc16637c0e1f77da7137146423e231c53be47bbaf832064ce		 pdf-font-stream PDF embedded font (sfnt) at offset 0x97F4 2048 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.