Malicious PDF — malware analysis report

Static analysis result for SHA-256 07cb60c5ca8e71d6…

MALICIOUS

PDF

42.0 KB Authoring application: Smallpdf Desktop
MD5: e17a5e739b95a8a6ea42e98bc3ad4608 SHA-1: 03b11b9e96de1b1be1b80b918542d2bc6ece602f SHA-256: 07cb60c5ca8e71d62013b7fa5b2296e75614b03034754935061eeac93bdc90fe
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded URLs pointing to other PDF files hosted on various domains, indicative of a link farm or SEO spamming operation. ClamAV detected this as 'Pdf.Phishing.TtraffRobotInstall-7605656-0', and a machine learning classifier also flagged it as malicious. The primary attack pattern involves leveraging these external links, potentially to distribute phishing content or manipulate search engine results.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://wabilalkalemat.com/uploads/1/3/0/5/130539763/1301539.pdf
    • http://www.inbloompermaculture.com/uploads/1/3/0/5/130550703/buditilelo-penosokojeba-buxuvim-pizapovusebiwa.pdf
    • http://lilahbazarte.com/uploads/1/3/0/4/130488311/moxidulewopater.pdf
    • http://usedhorsesaddles.com/uploads/1/3/0/5/130539886/5563892.pdf
    • http://thinkingspot.com.au/uploads/1/3/0/7/130775854/d083560a30e81.pdf
    • http://ardsleylatin.org/uploads/1/3/0/2/130271137/1490307.pdf
    • http://motusbehaviors.com/uploads/1/3/0/2/130288426/bokonakixavin-lexeneleli.pdf
    • http://gradebook.info/uploads/1/3/0/8/130874668/3ac70.pdf
    • http://meugrupovip.com/uploads/1/3/0/7/130739261/b179f0f7.pdf
    • http://bygollycandlesnmore.com/uploads/1/3/0/5/130551331/luzexikusojagabonuno.pdf
    • http://designjewelry.com/uploads/1/3/0/6/130604421/9110964.pdf
    • http://www.twosunsdoula.jomehndi.com/uploads/1/3/0/3/130323295/vegakat.pdf
    • http://organicbundle.com/uploads/1/3/0/2/130270905/tujusitabajibemivume.pdf
    • http://808enterprises.net/uploads/1/3/0/4/130476652/8642663.pdf
    • http://scotthuffman2018.com/uploads/1/3/0/3/130323322/rizoxuwapekuzeg-ruvudi-memup.pdf
    • http://impactwindowreviews.com/uploads/1/3/0/5/130589194/xalok_zilosuxefuvi_bujadazarez.pdf
    • http://lw8bn.bpmtc.com/uploads/1/3/0/5/130550696/130550696.html#norming+storming+forming+and+performing

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000048fa.bin
7cb3a46654831375823fe1bd033f99403fbce0443d6fe7fdcc4320f09a09a7eb		 pdf-font-stream PDF embedded font (sfnt) at offset 0x48FA 7908 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.