Malicious PDF — malware analysis report

Static analysis result for SHA-256 fcd0a1dcf3e84c2d…

MALICIOUS

PDF

46.0 KB Authoring application: Pdftk
MD5: 9ce937385d2c7af2db06602ff8afed66 SHA-1: 9d3568666af08b825b2085e251606812161ba81d SHA-256: fcd0a1dcf3e84c2dd34b520c63a735e64d1a57e6384713d7ed0bbb96ed26bac0
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF contains a large number of embedded links to other PDF files, indicating a link farm designed to distribute malicious content. ClamAV detected this as Pdf.Phishing.TtraffRobotInstall, and the ML classifier also flagged it as malicious. The primary attack pattern involves luring users to download further malicious PDFs.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://mta-sts.tangns.ie/uploads/1/3/0/7/130739120/7be51b.pdf
    • http://mywashcard.ca/uploads/1/3/0/5/130590482/nokop.pdf
    • http://stavangerfitness.com/uploads/1/3/0/4/130483581/7672274.pdf
    • http://cherryhilllawncare.com/uploads/1/3/0/7/130775950/povevewupoj.pdf
    • http://dreamfinancial.com.au/uploads/1/3/0/4/130476511/bda9c.pdf
    • http://onefootcandle.com/uploads/1/3/0/6/130604152/85269560.pdf
    • http://springvalleyvillagearborist.com/uploads/1/3/0/6/130639535/63164f.pdf
    • http://zimpresos.com/uploads/1/3/0/6/130621005/lupazuwimokunevi.pdf
    • http://sheilastonephotographer.com/uploads/1/3/0/4/130488429/rumelomexidolowamo.pdf
    • http://thepentaxpioneer.com/uploads/1/3/0/2/130274017/7872738.pdf
    • http://alseptumweb.com/uploads/1/3/0/8/130813730/39c496133.pdf
    • http://judithjack.com/uploads/1/3/0/7/130738974/5228817.pdf
    • http://web5.pleasingfood.com/uploads/1/3/0/7/130738859/130738859.html#acne+vulgaris+ppt+slideshare

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004629.bin
4d9ec2aec8f1ca6bebe1b56492fd55a77bba3a6e98efb76508c1b835d4eb9912		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4629 2860 bytes
font_01_sfnt_off00004fa1.bin
887f302533a294d63c033f0828492d7658a9d17f775992f408881f7845df32c9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4FA1 2008 bytes
font_02_sfnt_off00005b7b.bin
9095071b5a503a5716d99c8ce11aa2323bad59232d8e847992c0ba842a354ecc		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5B7B 8144 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.