Malicious PDF — malware analysis report

Static analysis result for SHA-256 eebad7172007989e…

MALICIOUS

PDF

54.7 KB Authoring application: Serif PagePlus
MD5: c35f17498f7f8ebea80d32c295a2f637 SHA-1: f4fac9261daa54bd41f74adaf1519ef8034eed7f SHA-256: eebad7172007989ec95994895d78188e61c90b5ebfc3fe9b0d73140c1ff0bc89
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded links to other PDF files, a technique often used for SEO poisoning or to distribute malware. The document body mentions 'Castle clash mod apk unlimited gems' to lure users. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the ML classifier output strongly indicate malicious intent, likely related to phishing or traffic redirection.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://escortbargain.com/uploads/1/3/0/4/130489358/nezomalusuzuwoxi.pdf
    • http://narayanahotelandresidences.com/uploads/1/3/0/4/130483820/gotokixoliguvuzibeki.pdf
    • http://mrfixitenterprises.com/uploads/1/3/0/5/130546432/5104675.pdf
    • http://ppas2020.com/uploads/1/3/0/6/130639708/zenoratumikif.pdf
    • http://mattsamberg.com/uploads/1/3/0/3/130312985/9635211.pdf
    • http://cornwall2theandes.com/uploads/1/3/0/4/130483761/wevexan.pdf
    • http://leadsolo.com/uploads/1/3/0/5/130589251/tapatez.pdf
    • http://muaarchi.com/uploads/1/3/0/5/130588487/3049869.pdf
    • http://hello-baby-toys.com/uploads/1/3/0/3/130323232/130323232.html#castle+clash+mod+apk+unlimited+gems

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000011bc.bin
6da2d30342e9d7439903e48748d30fb0090e19b84774ff289e0fdd851353edfb		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11BC 8804 bytes
font_01_sfnt_off0000726f.bin
9d1f368590a9ee1a39c9fecc68ed144d71fe7a5bf79c1ebbf8182da6231c9a03		 pdf-font-stream PDF embedded font (sfnt) at offset 0x726F 13424 bytes
font_02_sfnt_off0000902d.bin
779aa567746046747dac965df7fdfb06ff632674a0a99ce247a327bf89f0fa63		 pdf-font-stream PDF embedded font (sfnt) at offset 0x902D 16036 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.