Malicious PDF — malware analysis report

Static analysis result for SHA-256 00f34042dff4fb66…

MALICIOUS

PDF

77.9 KB Authoring application: PDF Studio
MD5: 984224f57cc88706e4a3a2e0504526ed SHA-1: 8543dff0e9b3509da99261deebd707b8fc816dad SHA-256: 00f34042dff4fb667a33b027fd9989136be84feb75958996c48ea52fac807fd6
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a link farm of numerous external PDF files, as indicated by the 'PDF_SEO_LINK_FARM' heuristic. The document body, despite being heavily obfuscated, contains references to religious text ('Yaseen surah dua') and includes several URLs that point to other PDF files. This suggests a phishing or redirection campaign designed to lead users to malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9973

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://36546739.nhd.weebly.com/uploads/1/3/0/6/130639755/5402004.pdf
    • http://mh-aero.de/uploads/1/3/0/5/130589250/ddef528ccb.pdf
    • http://becomeaconqueror.com/uploads/1/3/0/2/130289443/kozenipivuja.pdf
    • http://mycryosculpt.com/uploads/1/3/0/5/130545666/sogipifufedumus_sokolomofu_simuveme.pdf
    • http://wizteamwork.com/uploads/1/3/0/5/130540540/goxap.pdf
    • http://trustedservicesgp.com/uploads/1/3/0/7/130740558/1848900.pdf
    • http://somersetfoodtrail.org/uploads/1/3/0/5/130550925/130550925.html#yaseen+surah+dua
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License
    • http://www.gnu.org/copyleft/gpl.html

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_004_off00004b33.bin
ad64cca4a743e24b30d7e08b73f7d0a433a91f89f71e6e5614fdab833a69bd13		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x4B33 20228 bytes
font_00_sfnt_off0000118a.bin
a969dd668641989a767e378da7a3ed9681ddd1e6367c4db9832f76fd780c87c8		 pdf-font-stream PDF embedded font (sfnt) at offset 0x118A 8472 bytes
font_01_sfnt_off00004218.bin
8c3e96af02b08ba3443cc510220fb02f516919dde3a4996adad1dbfd8c88a3f9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4218 1636 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.