Malicious PDF — malware analysis report

Static analysis result for SHA-256 e3a05074fca05c16…

MALICIOUS

PDF

46.9 KB Authoring application: Mobipocket Creator
MD5: d9eade70c165d6a622d985a16ee98519 SHA-1: c85a77f4fd6cf8db9ccd504db76b328b4bf4dd83 SHA-256: e3a05074fca05c16fd0fa9b51a0175b05b71d9aba8d6ea7c00971fc74c1dc66b
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded links to external PDF files hosted on various domains, indicative of a link farm or distribution network. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the ML classifier output strongly suggest malicious intent. The primary attack pattern involves directing users to a network of potentially malicious or SEO-manipulated content via these links.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://adriantippetts.com/uploads/1/3/0/6/130621775/8951775.pdf
    • http://kennewickrealestateblog.net/uploads/1/3/0/5/130540128/975e0f5598c.pdf
    • http://mail.lourdas.com.gr/uploads/1/3/0/6/130621850/neluborijek.pdf
    • http://fashionrewind.net/uploads/1/3/0/2/130287873/gudinawabifeno_jevurogapox.pdf
    • http://ghdate.com/uploads/1/3/0/5/130588650/lamowajeparokiv.pdf
    • http://chefreyscatering.net/uploads/1/3/0/3/130313114/gululusevumuv-jijududogunuj-jepaxak.pdf
    • http://biggdaddysphillysteakhouse.com/uploads/1/3/0/4/130493816/7204070d5c7bb1.pdf
    • http://biblemindfulness.com/uploads/1/3/0/6/130605204/zemupaxu_gakemuzudos.pdf
    • http://riotthink.com/uploads/1/3/0/2/130287457/8290058.pdf
    • http://smartshopperautoparts.com/uploads/1/3/0/4/130476910/gelepakodeludurokifi.pdf
    • http://medmalneverevent.net/uploads/1/3/0/4/130476060/jatod.pdf
    • http://hollisharred.com/uploads/1/3/0/5/130541745/172333.pdf
    • http://bloggingwithbray.com/uploads/1/3/0/2/130288334/17768e7464be5f5.pdf
    • http://oppenheimerindustries.com/uploads/1/3/0/3/130313458/538ec0.pdf
    • http://namiwashcounty.org/uploads/1/3/0/4/130476743/ledavesij_nivebimutesel.pdf
    • http://mootsmarketing.com/uploads/1/3/0/3/130379610/ba053c6c7b.pdf
    • http://advbiocom.com/uploads/1/3/0/6/130620197/zugoli-wevamuxavuj-lerof-mebigogedesa.pdf
    • http://sagadaview.com/uploads/1/3/0/4/130435811/zobinejozod-rabokutujuwazan.pdf
    • http://a1836163xstreamtravel.xsideas.com/uploads/1/3/0/7/130738989/130738989.html#what+do+the+aggregate+supply+and+aggregate+demand+curves+describe

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005887.bin
f4c70e6bf4bda7185552e36acd4f7e055995a285468ecea75d74f0b0cc5e69d9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5887 8616 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.