Malicious PDF — malware analysis report

Static analysis result for SHA-256 f13b3f3064a4047e…

MALICIOUS

PDF

70.6 KB Authoring application: Poppler-utils
MD5: 32b202135e21a2bc1bc4e78779320c40 SHA-1: 5c248f0234da0c50f8e07a2239ecf01c89b63a40 SHA-256: f13b3f3064a4047eef720e5a42a7e1d31ecd0af5d85c952a8a49bfff26668f02
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

This PDF file was flagged by ClamAV as Pdf.Phishing.TtraffRobotInstall-7605656-0 and a machine learning classifier. It contains a large number of embedded external links to PDF files hosted on various domains, indicating a link farm or SEO poisoning attempt. The document body contains garbled text and URLs, further supporting the malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://mrelectricalservices.com.au/uploads/1/3/0/2/130287946/4489a593.pdf
    • http://valetudo.life/uploads/1/3/0/6/130639446/4bb5877ed0bf2cc.pdf
    • http://weddingcakesbrisbane.net/uploads/1/3/0/2/130289700/ruwemelilasi.pdf
    • http://theanxietyproject.org/uploads/1/3/0/5/130539325/lefikewora.pdf
    • http://theavamari.com/uploads/1/3/0/2/130272385/fuzegegozawud.pdf
    • http://leilaamani.com/uploads/1/3/0/6/130605341/jududa.pdf
    • https://bigumuron.weebly.com/uploads/1/3/0/5/130550796/6571769.pdf
    • http://calcorpinc.com/uploads/1/3/0/6/130605506/8584006.pdf
    • http://myartscout.com/uploads/1/3/0/4/130476271/jizipi.pdf
    • http://moneylifelessions.com/uploads/1/3/0/2/130287299/9650677.pdf
    • http://molecularo2.com/uploads/1/3/0/6/130604229/sixatoxaga-zezapizevev-wibesijominoz-losesupejawab.pdf
    • http://sweetestdreams.org/uploads/1/3/0/6/130603815/130603815.html#fallout+3+ultimate+modding+guide

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000013f0.bin
73c8a8eebcf1e9a819c7dca0f7a83ade0ce0eea7c166ef0d0526f803f0c3031c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13F0 9884 bytes
font_01_sfnt_off0000d800.bin
889e4a19de5d90756c0306f03dfdfee5b1f267dc045568e9bd092db3d0a081e8		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD800 3028 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.