Malicious PDF — malware analysis report

Static analysis result for SHA-256 019745757a9e779f…

MALICIOUS

PDF

38.8 KB Authoring application: pstoedit
MD5: 347aa81cfc81c37ea09247eb348ed15f SHA-1: 95ae594e88a17abef3a8bb047e9dfc00c67418a5 SHA-256: 019745757a9e779f444467c3c83d4ad7169cfdd1abe21f5081ca30a3c89b6b43
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious File

The PDF file contains a large number of embedded links to external PDF documents hosted on various domains. This behavior is indicative of a link farm or SEO manipulation tactic, and the ClamAV detection as Pdf.Phishing.TtraffRobotInstall-7605656-0 suggests a malicious intent to redirect users or distribute unwanted content. The ML classifier also strongly flagged this PDF as malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://crossingbridgeslifecoaching.com/uploads/1/3/0/5/130550764/5c6bfe22.pdf
    • http://longdistancevoter.com/uploads/1/3/0/5/130539881/5b0236b7c4.pdf
    • http://nekimastrategies.net/uploads/1/3/0/7/130775712/bobixudevepokef.pdf
    • http://mobcentric.net/uploads/1/3/0/8/130873958/pinekuje.pdf
    • http://drpattymain.com/uploads/1/3/0/4/130477584/a3214182da.pdf
    • http://bendstrength.com/uploads/1/3/0/7/130776750/180e10.pdf
    • http://4lifemovement.org/uploads/1/3/0/5/130551310/175fefc7.pdf
    • http://sumacandsage.com/uploads/1/3/0/5/130547999/fuxaxiwubuxox-betevunivepu-wisevikufolov-kibegakoti.pdf
    • http://pilateshighfields.com/uploads/1/3/0/6/130604136/kowamasoko.pdf
    • http://ikayak-siestakey.com/uploads/1/3/0/2/130270914/d219d0885fc7f.pdf
    • http://mail.crimsonriverministries.com/uploads/1/3/0/7/130739039/ba0add9cb94dce.pdf
    • http://babyboot.com.au/uploads/1/3/0/7/130776393/ripirelefeketos_bubofikex_fepoga_wekudu.pdf
    • http://daisxo415.xyz/uploads/1/3/0/4/130490915/dozazepiz.pdf
    • http://vsemdaryu.site/uploads/1/3/0/4/130490399/xulagofozof.pdf
    • http://mindfulpawscb.com/uploads/1/3/0/2/130271073/salinituxutepitoto.pdf
    • http://psychedelicsmadnessawakening.com/uploads/1/3/0/6/130621363/03380.pdf
    • http://darcmantona.com/uploads/1/3/0/3/130379769/c869d01d5.pdf
    • http://matthewforrest.com/uploads/1/3/0/5/130550887/3888712.pdf
    • http://www.whiteuntoharvest.net/uploads/1/3/0/6/130605476/lawoti.pdf
    • http://74-123-72-249.mgwnet.com/uploads/1/3/0/9/130968917/130968917.html#how+do+i+attach+a+pdf+in+a+word+document

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003884.bin
a7a0a03eab3d893b82c9d3c259357cea79842902dd0baabd56f2a628f67c760c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3884 8116 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.