Malicious PDF — malware analysis report

Static analysis result for SHA-256 fb13cdb2034b7667…

MALICIOUS

PDF

39.8 KB Authoring application: pstoedit
MD5: ea6c9086492af24f500e155c3a71a08c SHA-1: 046510cb6b16aec52315454abbab778c80e98fd1 SHA-256: fb13cdb2034b766788aaf6bfe8b80eedfce3d2682f3df8449221cb01724f6b4c
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1566.002 Spearphishing Link

The PDF contains a significant number of embedded links to external domains, identified by the PDF_SEO_LINK_FARM heuristic. The ClamAV detection as Pdf.Phishing.TtraffRobotInstall-7605656-0 and the ML classifier output strongly indicate malicious intent. The document body, though heavily obfuscated, contains references to medical terms and the embedded URLs, suggesting a lure to potentially malicious or phishing content hosted on these domains.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://datascienceeurope.com/uploads/1/3/0/4/130476270/f157458ff18e7b.pdf
    • http://911snowremoval.com/uploads/1/3/0/7/130775854/3954858.pdf
    • http://prodavaika.pro/uploads/2020/01/28/f492cfc7a1a72b2.pdf
    • http://rrqlaw.com/uploads/1/3/0/3/130313274/8893df30.pdf
    • http://beingself-centered.com/uploads/1/3/0/4/130490338/130490338.html#cardiac+tamponade+vs+constrictive+pericarditis

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001060.bin
d664a8f3539f14554dd7bb2738809b161cd3f4c83c9e70d64c911a2d7c4a086d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1060 8800 bytes
font_01_sfnt_off000060b8.bin
e2f1373bf3d70a40ff4276a486f0a1d2d32154e4f45ad1243a44c3d3b7d91cea		 pdf-font-stream PDF embedded font (sfnt) at offset 0x60B8 2652 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.