Malicious PDF — malware analysis report

Static analysis result for SHA-256 eb54a40837fa5cd6…

MALICIOUS

PDF

37.9 KB Authoring application: pdf-parser
MD5: c6459cb167bf8da16b20a2261e6c2ab5 SHA-1: 3899dd38450eba9f48029108e32cddc67c5e6f8d SHA-256: eb54a40837fa5cd6e365a2492d150c9eaf0853958c38ee39acf5fedd3c7d6571
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF was flagged by ClamAV as Pdf.Phishing.TtraffRobotInstall-7605656-0 and a machine learning classifier. The primary heuristic indicates a link farm with 31 external PDF links, suggesting a phishing or SEO manipulation scheme. The embedded URLs are likely used to redirect users to malicious sites or download further payloads.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://thebikinicloset.com/uploads/1/3/0/5/130542813/3d51a72761f610.pdf
    • http://www.quantum-environ.com/uploads/1/3/0/6/130620971/pokazuna_xavom_limezutamed.pdf
    • http://zendreaming.com/uploads/1/3/0/4/130435937/zezetuku.pdf
    • http://taptissparkleto.com/uploads/1/3/0/6/130620576/d55e6c15.pdf
    • http://truedefdentallaboratory.com/uploads/1/3/0/7/130776058/nidubamotop_rabifu_sejisibimi.pdf
    • http://chimneycarepros.mobi/uploads/1/3/0/6/130605338/vevowowo_sesowivuwijef.pdf
    • http://wainuiponyclub.org/uploads/1/3/0/7/130738759/bomaxajesokopilajafu.pdf
    • http://mail.smoochsoaps.com/uploads/1/3/0/2/130270845/begukivegedomip.pdf
    • http://adisera.com/uploads/1/3/0/7/130775134/jadirepemovu-pefoxotoba-xitilebekilepo.pdf
    • http://getautomotiv.com/uploads/1/3/0/5/130551339/e1ff253c9ee7.pdf
    • http://simonassi.com/uploads/1/3/0/4/130483232/jilegevog.pdf
    • http://mikepaganrealtor.com/uploads/1/3/0/3/130379070/pilidumiw-gituxavi-sogeg-jebij.pdf
    • http://beachsack.net/uploads/1/3/0/4/130435844/boxejaz.pdf
    • http://midtownatlantachiropractor.net/uploads/1/3/0/2/130270893/nimevegawijunu.pdf
    • http://miamipropertysharks.com/uploads/1/3/0/8/130874514/b2769865b9.pdf
    • http://lovewisdomfractal.com/uploads/1/3/0/5/130588749/bagofewulokudu.pdf
    • http://counselinginlafayette.com/uploads/1/3/0/3/130324072/rikarovixaguvipifej.pdf
    • http://contemporarypublishing.com/uploads/1/3/0/5/130551692/473640.pdf
    • http://koininjas.com/uploads/1/3/0/6/130604487/0320b04dc.pdf
    • http://kroppsskydd.se/uploads/1/3/0/5/130588744/4620763.pdf
    • http://xingheyulechengguanwang.br3h.com/uploads/1/3/0/6/130639557/130639557.html#delegatus+non+potest+delegare+what+does+it+mean

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003562.bin
2f7283a31fcda2fe0601b63a6a291b712683e6306f5dbce5c7b6f4a8505c3cc1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3562 7584 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.