Malicious PDF — malware analysis report

Static analysis result for SHA-256 f5652733d0a5981a…

MALICIOUS

PDF

50.6 KB Authoring application: PDF Studio
MD5: e2f2cd98d900700fc54e53493b724666 SHA-1: e87f2074d070b8e1ed0978125c2d4262727f8e26 SHA-256: f5652733d0a5981a1e62e32c485fa7feffe544b33643f7fa2ce9abc4704cf1ab
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of external links, identified as a 'link farm', suggesting a malicious redirection or phishing attempt. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a phishing or traffic redirection purpose. The embedded document body text, while containing economic terms, is likely obfuscation or filler content. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://jamesmcleodvo.com/uploads/1/3/0/6/130621226/bokaxanud_vodinovusimorom_gonixotetonido_nulufujevuve.pdf
    • http://staceycampfield.com/uploads/1/3/0/6/130604931/ab868328.pdf
    • http://www.updatemarketing.us/uploads/1/3/0/5/130545816/8352736.pdf
    • http://twobobpoker.com/uploads/1/3/0/4/130436182/698d43.pdf
    • http://myclarendonhills.com/uploads/1/3/0/2/130288549/2192624.pdf
    • http://draftav.com/uploads/1/3/0/8/130813509/novorole_totidupetopilag.pdf
    • http://bogolist.com/uploads/1/3/0/6/130604425/c952bc3.pdf
    • http://natashacorriephotography.com/uploads/1/3/0/6/130639854/1998847.pdf
    • http://ontherolljoplin.com/uploads/1/3/0/4/130488631/8566256.pdf
    • http://beyondpotential.ca/uploads/1/3/0/5/130590420/tubotitumoj.pdf
    • http://guangxingmianfeikaihu.br3h.com/uploads/1/3/0/6/130620949/130620949.html#in+the+short+run+if+the+marginal+cost+is+equal+to+the+average+variable+cost+the+firm

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000055fe.bin
b080e6aa9682ff87567a230b404ab00780bafcfd3ba11e3f536b788ca6e08ef5		 pdf-font-stream PDF embedded font (sfnt) at offset 0x55FE 16060 bytes
font_01_sfnt_off00006dc7.bin
20e7d5a33f8ac295f4d141873ded993ad9538b26e819d3c7a7786a7119746eac		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6DC7 8932 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.