Malicious PDF — malware analysis report

Static analysis result for SHA-256 076791fbb48ed664…

MALICIOUS

PDF

34.7 KB Authoring application: Solid Converter PDF
MD5: 8408a8091b5b9b5a991bd513cc6aaa5d SHA-1: fb4b5dfce3a91fa85d9f96162dba6794572d3050 SHA-256: 076791fbb48ed6648d5c7839e8385fc2810251c3bd63887229fdc629379a741d
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic, suggesting a link farm designed to redirect users to potentially malicious content. The ML_NYX_PDF_MALICIOUS and ClamAV detections further support its malicious nature. While no scripts were explicitly extracted, the structure and heuristics point towards a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://five9demos.com/uploads/1/3/0/6/130640132/4412c5f78d.pdf
    • http://foj.relampagomagalu.com/uploads/2020/01/29/liwibimoj-wiweparenetag.pdf
    • http://zuved.uborka-kvartir-v-moskve.pro/uploads/2020/01/27/nupikeg.pdf
    • http://photosbyjamal.com/uploads/1/3/0/6/130620889/1214963.pdf
    • http://smartmix.xyz/uploads/2020/01/27/puvam.pdf
    • http://2000jobsllc.com/uploads/1/3/0/6/130621226/8145947.pdf
    • http://mydonutbarn.com/uploads/1/3/0/4/130476039/baloxavug.pdf
    • http://cancercoloring.com/uploads/1/3/0/6/130604903/mivuparejoner.pdf
    • http://madfor.info/uploads/1/3/0/3/130323928/310877.pdf
    • http://quillesthon.com/uploads/1/3/0/3/130323180/pojekepu.pdf
    • http://jakigeorgesculpture.com/uploads/1/3/0/2/130291350/2753456.pdf
    • http://miamasi.weebly.com/uploads/1/3/0/6/130621032/4304792.pdf
    • http://smoothmedia.solutions/uploads/1/3/0/5/130551656/28820.pdf
    • http://crafted-by-yaime.com/uploads/1/3/0/6/130640029/130640029.html#bv+raman+astrology+pdf

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000012fd.bin
794358253c4c362fb5d6d63299035c41e992af70c0ab4d7c527e78c917927036		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12FD 8096 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.