Malicious PDF — malware analysis report

Static analysis result for SHA-256 07c1cebc056e0e71…

MALICIOUS

PDF

66.1 KB Authoring application: Nitro PDF First seen: 2020-09-24
MD5: 7320a12fa9887cc1b53bba033eeb4959 SHA-1: 6f4a00c5764efa9c30114d695e48d829fc0a7088 SHA-256: 07c1cebc056e0e7184778d96d52332169fcf54c43476d598f77b0dd291b192bb
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1105 Ingress Tool Transfer

The PDF file was identified as malicious by multiple heuristics, including a critical PDF_SEO_LINK_FARM rule and ClamAV detection as Pdf.Phishing.TtraffRobotInstall-7605656-0. The document contains a large number of embedded external URLs, suggesting an attempt to redirect users to malicious content or download further payloads. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://solfeggiohypnosis.com/uploads/1/3/0/6/130621903/mobitewumiromidileka.pdf In PDF document text
    • http://mybulletproofart.com/uploads/1/3/0/6/130620364/zosuwakobemuzu.pdfIn PDF document text
    • http://keyautonj.com/uploads/1/3/0/4/130483376/8486901.pdfIn PDF document text
    • http://r-ewolucje.com/uploads/1/3/0/7/130740187/3987116.pdfIn PDF document text
    • http://redandrio.com/uploads/1/3/0/6/130620509/pimetotonizis.pdfIn PDF document text
    • http://nadiaberyl.fr/uploads/1/3/0/6/130640219/9d5feacf8b51.pdfIn PDF document text
    • http://lisascentralcoast.com/uploads/1/3/0/4/130483338/ruvaluluradotiwogo.pdfIn PDF document text
    • http://gearsgears.com/uploads/1/3/0/6/130604061/6593087.pdfIn PDF document text
    • http://knitvegan.com/uploads/1/3/0/3/130313378/wifejese.pdfIn PDF document text
    • http://realmorrowpost.com/uploads/1/3/0/3/130313306/4167070.pdfIn PDF document text
    • http://anteako.com/uploads/1/3/0/6/130621829/kadix_dudexale_sevebobaman.pdfIn PDF document text
    • http://azseniorresourcesandmore.com/uploads/1/3/0/6/130603747/zomawatow.pdfIn PDF document text
    • http://thehappygirlstore.com/uploads/1/3/0/5/130588724/130588724.html#categorical+data+analysis+using+sas+third+edition+pdfIn PDF document text
🗂 Part of campaign: keyautonj.com 3 samples

Related samples 2

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001390.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1390 8684 bytes
SHA-256: e58334aaa2ac1b15a8be9f32607a18e21e0fa485c68b19d5450c1ec6374fe979

Open this report in the interactive analyzer, or submit your own file for analysis.