Malicious PDF — malware analysis report

Static analysis result for SHA-256 00a8aa2e70203b8a…

MALICIOUS

PDF

36.2 KB Authoring application: Soda PDF
MD5: e51b2428020d256346e1a2db674583eb SHA-1: 08fb7f7c1d7675cd23b89128466a019c012979d8 SHA-256: 00a8aa2e70203b8a63bad84450d2978bc9cf5937cc5dd984ba1b638b48512797
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a large number of embedded URLs, indicating a link farm designed to redirect users to malicious content. The heuristic 'PDF_SEO_LINK_FARM' and ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' strongly suggest a phishing or redirection campaign. The document body, though partially corrupted, contains references to medical terms and URLs, likely as a lure.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://2030portal.com/uploads/1/3/0/5/130540240/3496469.pdf
    • http://resiliencepsychotherapy.com/uploads/1/3/0/4/130483200/kijesig-fovuvup-pesamefasogur-wewaw.pdf
    • http://cbenedict.com/uploads/1/3/0/5/130589415/6347288.pdf
    • http://jiso.trikamethod.site/uploads/2020/01/27/zepugobev-kudidupuj-wokuzari.pdf
    • http://webografix.ca/uploads/1/3/0/2/130274263/bivafexotixon.pdf
    • http://fiz.speacetech.us/uploads/2020/01/28/11bad.pdf
    • http://killjoy.info/uploads/1/3/0/3/130379246/3815222.pdf
    • http://metroeastinterfaith.com/uploads/1/3/0/2/130273761/1afb651d79a84.pdf
    • http://fearoftheunknownseries.com/uploads/1/3/0/6/130620881/89903185fee7.pdf
    • http://shardexplorers.com/uploads/1/3/0/6/130621155/130621155.html#subacromial+bursal+inflammation

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000011f1.bin
9e683405bee7413bd7961ee03662f19b4fdc632deb3f5c48ff8aab51b95ec3b0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11F1 7788 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.