Malicious PDF — malware analysis report

Static analysis result for SHA-256 073501a32efc508a…

MALICIOUS

PDF

37.4 KB Authoring application: PDFedit
MD5: 05d7f302b083d63699c94354cb400881 SHA-1: eb10e3873585c83b614e9e51fed240c1521092e5 SHA-256: 073501a32efc508ab3185b6ae809586991281291a4af42fafbe035e913be8219
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. These links point to various PDF files hosted on different domains, suggesting a link farm or redirection mechanism. The ML classifier and ClamAV detection strongly indicate malicious intent, likely related to phishing or malware distribution through these linked documents.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ularooms.com/uploads/1/3/0/4/130479472/2138841.pdf
    • http://crinklecon.com/uploads/1/3/0/2/130274258/5631317.pdf
    • http://timberframing.ca/uploads/1/3/0/6/130604011/tejulomab_gebosuxoxer_pipemutuweja_mulefifesuli.pdf
    • http://okesto.com/uploads/1/3/0/4/130488295/mevarevigidek.pdf
    • http://delbuck.com/uploads/1/3/0/6/130605504/jumaru_zasajuralutoka_wajitujukum_xepivavuriko.pdf
    • http://mesutcelik.com/uploads/1/3/0/6/130639755/3552907.pdf
    • http://san69.com/uploads/1/3/0/6/130620678/bunemufel.pdf
    • http://mylsathouse.com/uploads/1/3/0/6/130621912/610080.pdf
    • http://monextranet.ca/uploads/1/3/0/3/130313436/315043.pdf
    • http://broadbybias.com/uploads/1/3/0/5/130543813/00d0302451f312.pdf
    • http://aprollers.com/uploads/1/3/0/6/130639854/tofufifu-rizosenapug.pdf
    • http://laparoscopic.info/uploads/1/3/0/2/130289628/434cfc.pdf
    • http://demitrydevelopment.com/uploads/1/3/0/5/130546385/7c377b.pdf
    • http://revenuelist.com/uploads/1/3/0/6/130639227/6626168.pdf
    • http://michaelshusko.com/uploads/1/3/0/6/130639143/130639143.html#advantages+of+biological+control+over+pesticides

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000397e.bin
1f44aa95b2b3d668573172c8ccbd8f8e09aa11c433e9bea05a984c697a9a4933		 pdf-font-stream PDF embedded font (sfnt) at offset 0x397E 7648 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.