Malicious PDF — malware analysis report

Static analysis result for SHA-256 deea66fc2d10e316…

MALICIOUS

PDF

40.3 KB Authoring application: Adobe PDF Library 9.0
MD5: 154cc5d237b97c7729c25aaccc4843de SHA-1: 750fcba22a8fe5de607f83e3abbed369d9dd7d5f SHA-256: deea66fc2d10e316ec5c50701823987bba6568cdc77236402dfc99c587c5105d
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded links to external PDF documents hosted on various domains. This behavior is indicative of a link farm or redirection scheme, commonly used to distribute malware or conduct phishing attacks. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports the malicious nature of this file. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ciarawiegers.com/uploads/1/3/0/2/130271099/6237346.pdf
    • http://bpoconcierge.com/uploads/1/3/0/5/130551335/gavovut.pdf
    • http://crownemarketgroup.com/uploads/1/3/0/6/130603828/matol_tezep.pdf
    • http://amh2sl.salon225.com/uploads/1/3/0/2/130289353/dawenuze.pdf
    • http://messianicmetis.ca/uploads/1/3/0/6/130605107/gukojitiwedad-nowupi.pdf
    • http://custominteractive.net/uploads/1/3/0/6/130620971/jukatozozul-nefuwasol-nudizurixotul.pdf
    • http://myxlplyx.com/uploads/1/3/0/2/130288811/letufafokixuzajux.pdf
    • http://mail.chilingpai.com/uploads/1/3/0/5/130550760/1f97ed79f5d1911.pdf
    • http://adogslifeoxon.com/uploads/1/3/0/5/130588780/cc9fa5e630.pdf
    • http://ocholistictherapy.com/uploads/1/3/0/3/130379461/vaxekenifare.pdf
    • http://www.tonytatatraining.com/uploads/1/3/0/3/130313588/lokeko.pdf
    • http://carainteriors.ca/uploads/1/3/0/2/130289063/0cc8284e21d4f2.pdf
    • http://moir.se/uploads/1/3/0/3/130379132/mepanabizuj_dodot_tegopifika_jipagowitu.pdf
    • http://www.elearningprose.com/uploads/1/3/0/7/130739479/c6731450d7.pdf
    • http://saharaaljazeera.com/uploads/1/3/0/8/130874504/mikiguguzej_zarux_rudetojafulu_tisozugotun.pdf
    • http://carecanvas.com/uploads/1/3/0/6/130622110/54c96.pdf
    • http://somethingelse.org.uk/uploads/1/3/0/6/130604733/jitizig-gupil.pdf
    • http://baccarat-online.lucky1st.com/uploads/1/3/0/4/130476505/130476505.html#train+service+from+jfk+airport+to+manhattan
    • http://ocholistictherapy.com/up

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003ed7.bin
6cef2f50f0d3fe62ba53cbcc8cd943eaffa9ae38be80c75cca2e47336e0b52c1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3ED7 8568 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.