Malicious PDF — malware analysis report

Static analysis result for SHA-256 00f277080a1caaa2…

MALICIOUS

PDF

40.1 KB Authoring application: pstoedit
MD5: 7dc7c3e1e1d0cda9f1d2bf5f383f634e SHA-1: b3be4d0fa14099844d80ea7d284bcc6ce0e80d36 SHA-256: 00f277080a1caaa2bed70e79fe551f8b20eb2dcbf2b69f3a482f3ef41b1bc3a5
160 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Phishing:Spearphishing Attachment T1204.002 Malicious Link:Malicious File

The PDF contains a large number of embedded external links, identified as a 'PDF_SEO_LINK_FARM' heuristic. This suggests a malicious intent to manipulate search engine results or to distribute further malicious content via these links. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a phishing or malicious distribution vector. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://lipenevarulotez.weebly.com/uploads/1/3/0/6/130604415/2218841.pdf
    • http://nantymoelprimary.com/uploads/1/3/0/4/130489567/4270721.pdf
    • http://knappd.net/uploads/1/3/0/3/130313293/6274541.pdf
    • http://teamredangus.com/uploads/1/3/0/6/130621385/33e151397.pdf
    • http://albertonorchids.com/uploads/1/3/0/2/130272275/63e6506.pdf
    • http://whatthehula.net/uploads/1/3/0/5/130539244/7141545.pdf
    • http://afaparents.org/uploads/1/3/0/3/130323814/dd49cd8bafe184.pdf
    • http://menschwork.com/uploads/1/3/0/4/130477455/rebolaj.pdf
    • https://tidovizale.weebly.com/uploads/1/3/0/5/130588418/zinidomeninix.pdf
    • http://ashevilletransport.net/uploads/1/3/0/5/130551720/ada7b.pdf
    • http://northnodconsultants.com/uploads/1/3/0/5/130540437/kevigadifonopo-woxuni.pdf
    • http://swingingaider.com/uploads/1/3/0/5/130546486/59ca233e8.pdf
    • http://krishnaandnatansh.com/uploads/1/3/0/5/130544413/9664166.pdf
    • http://cloud-token-wallet.com/uploads/1/3/0/6/130620833/volurakujevamigofego.pdf
    • http://felubima.like-cntr.com/uploads/2020/01/28/fazafuxadatuxa.pdf
    • http://airbreather.net/uploads/1/3/0/6/130620325/tifedadidu.pdf
    • http://behumble.fitness/uploads/1/3/0/5/130589415/zomafex_roninegago_muxetoda.pdf
    • http://silverspurcamp.com/uploads/1/3/0/3/130379169/sukigijibesuvu.pdf
    • http://rencommunicatons.com/uploads/1/3/0/6/130639428/6585485.pdf
    • http://bsa-sccc-pack301.com/uploads/1/3/0/2/130273626/130273626.html#dear+mr+kilmer+novel+answer

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000168c.bin
f40dd733c9433aeb1cfffdd78e55dd2ecb8859cd445e05f2071df82cb58c8928		 pdf-font-stream PDF embedded font (sfnt) at offset 0x168C 7812 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.