Malicious PDF — malware analysis report

Static analysis result for SHA-256 dd9d051e7366bb86…

MALICIOUS

PDF

70.2 KB Authoring application: Mobipocket Creator
MD5: bf2429d91406e18dbe7523b94f600517 SHA-1: 768702273c0e0b1a1241718af0a853eb3f116f68 SHA-256: dd9d051e7366bb864ddb56b1ee49006bdcfd1bc30c3be623c75cc59b3da83de6
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded links, as indicated by the PDF_SEO_LINK_FARM heuristic. This suggests a phishing or SEO spam campaign. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a malicious intent. No scripts were extracted from this sample, and the document body contained mostly obfuscated or irrelevant text.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://thefundamentallife.com/uploads/1/3/0/6/130604590/9858810.pdf
    • http://stoneforcepavingandmasonry.com/uploads/1/3/0/4/130483632/0d09f06ff3.pdf
    • http://nancymaldonado.com/uploads/1/3/0/5/130551140/vijarope.pdf
    • http://nanni.info/uploads/1/3/0/4/130476288/xotubut-podifero-bowiworelod.pdf
    • http://nataliereneesteffen.org/uploads/1/3/0/4/130488228/744859.pdf
    • http://mychoicewellness.com/uploads/1/3/0/4/130483302/efb316716.pdf
    • http://ntscdfregionals.com/uploads/1/3/0/3/130323466/2647207.pdf
    • http://sinofusionrestaurant.com/uploads/1/3/0/7/130740464/furejajar.pdf
    • http://deannaheon.com/uploads/1/3/0/2/130291624/9880175.pdf
    • http://researchtipsk12.com/uploads/1/3/0/4/130476671/tavutobajirepijikivi.pdf
    • http://tinex.hangxao.com/uploads/2020/01/28/xifakoweti.pdf
    • http://ashtoninsuranceagents.com/uploads/1/3/0/5/130588419/nalibolozutel.pdf
    • http://djspizza1.com/uploads/1/3/0/4/130483110/130483110.html#land+registry+easements+practice+guide

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000155c.bin
b51d6affa6cad55b3657b17c864e548a4ed859eec0b3b4e045de8eb51ad8723d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x155C 8432 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.