Malicious PDF — malware analysis report

Static analysis result for SHA-256 dd183d2958aa02c2…

MALICIOUS

PDF

90.4 KB Authoring application: PDFedit
MD5: 1f4862be5678dcbf3452a96af9899de5 SHA-1: dc19b7dd71113ab80910da217a0403311db64cf3 SHA-256: dd183d2958aa02c23915b7cafe5445b773a1b8540aa1de4c223a74164fc8af1a
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded links to external PDF files hosted on various domains, indicating a link farm or redirection strategy. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the ML classifier's high confidence score further support a malicious classification. The document body's content is heavily obfuscated and does not provide clear user-facing text, but the overall structure and heuristic firings point to a phishing or traffic-driving scheme.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://millionairesclub.biz/uploads/1/3/0/7/130738753/4542c42b.pdf
    • http://aysenurguler.com/uploads/1/3/0/2/130288334/fe22b0cbcbf.pdf
    • http://nomadcc.com/uploads/1/3/0/5/130552106/jepano_penozeb_lijuxutojivufu_muniwozoref.pdf
    • http://draamasalo.com/uploads/1/3/0/5/130539419/jirovipovopufo.pdf
    • http://theknittingroom.co.uk/uploads/1/3/0/2/130271184/4844936.pdf
    • http://aokassistantservices.com/uploads/1/3/0/6/130621059/6194835.pdf
    • http://help4helpless.org/uploads/1/3/0/7/130776138/95405add45.pdf
    • http://mx.peopleripple.com/uploads/1/3/0/3/130324278/beluwefapuleritodomo.pdf
    • http://fieldsmovie.com/uploads/1/3/0/7/130775458/3456206.pdf
    • http://joyinocencio.com/uploads/1/3/0/4/130476442/4210988.pdf
    • http://2003ebaenglandscotlandtrip.com/uploads/1/3/0/5/130543107/wotuxoku.pdf
    • http://kittoconsultancy.com/uploads/1/3/0/6/130621459/zatutofemow_taduk.pdf
    • http://golcondabuttefarms.com/uploads/1/3/0/7/130775209/feraxuso_fegumiw_pikidefuvofuxi.pdf
    • http://themagicalcryptofriendsshow.com/uploads/1/3/0/2/130272853/9896780.pdf
    • http://shalong365yulechengkaihu.f18.ebkf.org/uploads/1/3/0/6/130604187/df6ad11ee53.pdf
    • http://occamsraiser.com/uploads/1/3/0/5/130539926/jatil.pdf
    • http://mta-sts.jhigh18.com/uploads/1/3/0/5/130545733/130545733.html#describe+how+microbes+serve+as+biological+control+agents+of+plant+diseases+and+pests

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005fa1.bin
d2043ff798e18ace75ce46a9541494da740e8aa64e70a02a1b050a160b7a9f24		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5FA1 9348 bytes
font_01_sfnt_off0001212e.bin
a243e69de24910a96414c6718152e42c8541de8a471ad62f3e8fef0bcaf8ad46		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1212E 5668 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.