Malicious PDF — malware analysis report

Static analysis result for SHA-256 de6c29a25efdfcc1…

MALICIOUS

PDF

44.9 KB Authoring application: Mobipocket Creator
MD5: 11c2e7a11329ce10fa2be391171eb716 SHA-1: a1842bbe2c99c26dc98e622bf2c6483a59fe1910 SHA-256: de6c29a25efdfcc1d5b4e99f53c7b01108604e5386d439bef96c68182e5ed68c
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. The ML classifier and ClamAV detection strongly indicate malicious intent, classifying it as Pdf.Phishing.TtraffRobotInstall. The document body, though partially obfuscated, also contains many of these links, suggesting a phishing or SEO manipulation scheme. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://voiceschorale.org/uploads/1/3/0/3/130313027/tusejivuvogale.pdf
    • http://visitwesternheritagecenter.org/uploads/1/3/0/6/130620605/verimanuwugof_sololi_ritutawigawuv_kalekepasisatuj.pdf
    • http://drhiura.net/uploads/1/3/0/6/130621730/acebf607ed2e8.pdf
    • http://villageartproject.com/uploads/1/3/0/3/130313228/2ba036c628.pdf
    • http://mikewoodhead.com/uploads/1/3/0/3/130313157/guzuren-gopojufapin-ruvavegikobu-bivoxowokodof.pdf
    • http://theallergyfreezone.com/uploads/1/3/0/5/130542755/91dcd5132151.pdf
    • http://aearthsport.com/uploads/1/3/0/6/130605302/vajubisipo_gokubefe_mexuso_kisawamuzikofa.pdf
    • http://aninconvenientcommute.com/uploads/1/3/0/5/130551271/lejogikus.pdf
    • http://billyjackray.com/uploads/1/3/0/6/130639947/gaxozevi_zovolej_fukas.pdf
    • http://309brightfuture.org/uploads/1/3/0/6/130604427/7139468.pdf
    • http://love-your-mind.com/uploads/1/3/0/2/130291552/aadc6aa6.pdf
    • http://kylaconner.com/uploads/1/3/0/5/130588827/130588827.html#jcole+4+your+eyez+only+download

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001359.bin
818ec4cc306d44ef817a1a57ce77a0bb9be03be06407d55f5c9021bbee0314ed		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1359 8116 bytes
font_01_sfnt_off000062f2.bin
bdcfe833d3631b708f0b8a76b8d82f8a11cc6cd4486a9bbbdd73a01ab4899b53		 pdf-font-stream PDF embedded font (sfnt) at offset 0x62F2 8716 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.