Malicious PDF — malware analysis report

Static analysis result for SHA-256 ded6a9ea1f92d87c…

MALICIOUS

PDF

37.9 KB Authoring application: Adobe PDF Library 9.0
MD5: be512d63fa37d54193c2dbba7628f700 SHA-1: 1eeb59673dbfee935bdc4b42a7552f49f11ece4a SHA-256: ded6a9ea1f92d87ccc280a36901d422b23df9e638294b27d7d0d18d1fcf10c7a
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded links to external PDF files, a technique often used for SEO manipulation or to distribute further malicious content. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the ML classifier strongly indicate malicious intent. The primary attack pattern involves directing users to a network of linked PDFs hosted on various domains.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://simdisplays.com/uploads/1/3/0/6/130603989/luxafaselesode-dusilofamefos.pdf
    • http://saturnsthoughts.com/uploads/1/3/0/5/130551402/38470d.pdf
    • http://tacoandmonkey.com/uploads/1/3/0/6/130621250/tuvosagifab-dodoxeviwafaka.pdf
    • http://edumorethailand.com/uploads/1/3/0/3/130313582/2959611.pdf
    • http://palmsrealty.org/uploads/1/3/0/3/130313603/kizaju_vuzus.pdf
    • http://diabetesasia.com.my/uploads/1/3/0/7/130776425/47927016e562dca.pdf
    • http://mhcsi-bath.com/uploads/1/3/0/7/130776394/9664101.pdf
    • http://www.aguidinglight2014.com/uploads/1/3/0/5/130551237/1143396.pdf
    • http://joemarianek.design/uploads/1/3/0/6/130640091/fudiketasalipag.pdf
    • http://saaqld.com/uploads/1/3/0/7/130739491/4663126.pdf
    • http://dailyboatdeals.com/uploads/1/3/0/7/130775336/10b7e9c3e19a303.pdf
    • http://an10i.com/uploads/1/3/0/2/130287269/449028.pdf
    • http://mercury-dime.net/uploads/1/3/0/7/130775370/kodigagu.pdf
    • http://nataliekfitness.com/uploads/1/3/0/7/130775939/3866444.pdf
    • http://noclintonsnomore.com/uploads/1/3/0/4/130476650/3d11e596693.pdf
    • http://indianapolistruckingacademy.com/uploads/1/3/0/6/130639393/63ad5f782248.pdf
    • http://drashmani.com/uploads/1/3/0/5/130551338/352ca9cde4e98.pdf
    • http://shawndgay.com/uploads/1/3/0/5/130539875/37245d38.pdf
    • http://74-123-78-242.mgwnet.com/uploads/1/3/0/4/130435520/130435520.html#astrology+synastry+chart+reading
    • http://dailyboatdeals.com/u

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003533.bin
71200f4cf2881bbccbd5309bb27d6429b3e726de47f0a05d8498f7cf5c739e76		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3533 8464 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.