Malicious PDF — malware analysis report

Static analysis result for SHA-256 07bf42c0e65b79d2…

MALICIOUS

PDF

36.7 KB Authoring application: QPDF First seen: 2020-09-24
MD5: 11e1ac2857f2efcc7950a404041a60c7 SHA-1: 15a6399987190f3d393e5973456209eca83fbc21 SHA-256: 07bf42c0e65b79d257063c78107c2f00f35c3fe07860d7f8484fcb446e121c5d
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file was flagged by multiple heuristics, including a critical finding for a large number of external links, suggesting a link farm. ClamAV also detected it as malware, specifically 'Pdf.Phishing.TtraffRobotInstall-7605656-0'. The embedded URLs likely lead to phishing sites or further malware downloads.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.stephenezequiel.com/uploads/1/3/0/7/130776326/8ddb49.pdf In PDF document text
    • http://floridarealestatemarketing.com/uploads/1/3/0/7/130776336/5587724.pdfIn PDF document text
    • http://jonfreeland.net/uploads/1/3/0/7/130739713/361b778e.pdfIn PDF document text
    • http://evergreen-memorials.com/uploads/1/3/0/7/130776886/5157769.pdfIn PDF document text
    • http://www.effloraison.fr/uploads/1/3/0/7/130775525/3edb38d.pdfIn PDF document text
    • http://mrmanateepoolservice.com/uploads/1/3/0/6/130639777/mevinujegigep_kakafanezos_gagad_jijebi.pdfIn PDF document text
    • http://romneyevent.com/uploads/1/3/0/6/130621786/webigop_kirutevij.pdfIn PDF document text
    • http://lspeg.com/uploads/1/3/0/6/130640074/wezivibuwited.pdfIn PDF document text
    • http://onceuponapage.net/uploads/1/3/0/7/130739141/rikivejumidu.pdfIn PDF document text
    • http://1169certified.org/uploads/1/3/0/3/130379058/kusatidozujirelumeja.pdfIn PDF document text
    • http://new.mgh-r.ch/uploads/1/3/0/4/130476616/130476616.html#rdt+malaria+vivaxIn PDF document text

Related samples 3

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003988.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3988 7964 bytes
SHA-256: 19ad475fc803331e2904c8ce47ebe8fe72da80823db30eb0e5d7866dbcc8e461

Open this report in the interactive analyzer, or submit your own file for analysis.