PDF malware analysis — malicious · fb27c8242249e887

MALICIOUS

PDF

38.8 KB Authoring application: Adobe PDF Library 9.0

MD5: f3b8161a7e5224702f9de13f4ec13f32 SHA-1: baeae9e0558301d45288446b51eb6f15dfbb1457 SHA-256: fb27c8242249e887d0611ec926f40c87a342f0cc28dabb4506d7d8a15724dde7

150 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious File

The PDF contains a large number of embedded links to external PDF files hosted on various domains, a technique often used for SEO manipulation or to distribute further malicious content. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the ML classifier strongly indicate malicious intent. The document body text is heavily obfuscated and does not provide clear user-facing content, but the heuristic firings are sufficient to determine the attack pattern.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://rusticfurnitureandmore.com/uploads/1/3/0/6/130639760/2114918.pdf
- http://mammybooks.com/uploads/1/3/0/6/130621741/3b8ba05af9c258.pdf
- http://casparscatering.com.au/uploads/1/3/0/6/130604169/gewumaviluwe.pdf
- http://comecleandetail.com/uploads/1/3/0/6/130621141/kivaf.pdf
- http://roscomedia.org/uploads/1/3/0/6/130639915/bojana.pdf
- http://www.writing4content.com/uploads/1/3/0/5/130589277/b2b3a47a025d05a.pdf
- http://stressadvantage.com/uploads/1/3/0/5/130547340/7dbaa1d8ea8642.pdf
- http://professionalgardens.net/uploads/1/3/0/5/130539188/nofotepe.pdf
- http://comfibody.co.uk/uploads/1/3/0/2/130272438/badopuxilutukis.pdf
- http://wer4jesus.com/uploads/1/3/0/2/130270990/8301625.pdf
- http://preferredstocklosses.com/uploads/1/3/0/8/130873850/nozomige.pdf
- http://richmondheightsviews.com/uploads/1/3/0/9/130969724/b8e767.pdf
- http://tomballcougarhigh.com/uploads/1/3/0/7/130775752/1047292.pdf
- http://justbreathelifecoach.com/uploads/1/3/0/5/130551294/wifixidavipogavewa.pdf
- http://mvhsphotography.com/uploads/1/3/0/4/130489075/novusol.pdf
- http://urbanshamanmagic.com/uploads/1/3/0/7/130776307/568892d82b9.pdf
- http://veropolo.org/uploads/1/3/0/6/130604789/4376440.pdf
- http://www.storyimpactgroup.com/uploads/1/3/0/4/130491444/2d378.pdf
- http://www.mathkidsannarbor.com/uploads/1/3/0/7/130776725/7178952.pdf
- http://andresbarbosa.com/uploads/1/3/0/4/130478123/dafilusidoromuzeroko.pdf
- http://www.nicholasbishopibcas.org/uploads/1/3/0/7/130739793/193020.pdf
- http://melaniescaribbeancuisine.com/uploads/1/3/0/3/130379474/e808b94686ccc1f.pdf
- http://www.kmcreecy.com/uploads/1/3/0/5/130541131/99a1ab0d8e01fb.pdf
- http://humpart.com/uploads/1/3/0/6/130604230/b71e72.pdf
- http://cochisewine.com/uploads/1/3/0/4/130435638/tanuvewatukijim_noduzeseluxax_nuwulilipumufi_zavotide.pdf
- http://sixtarubio.com/uploads/1/3/0/6/130620598/130620598.html#java+se+8+new+features+pdf
- http://www.writing4content

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00003277.bin` `f21d2b94ab9edb040e43e10ad56c46a6e94e6b4382d7ddec6a1da82565c59309`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x3277	8116 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.