Malicious PDF — malware analysis report

Static analysis result for SHA-256 0fd6ff892176b9c1…

MALICIOUS

PDF

42.1 KB Authoring application: Pdftk
MD5: ffb0d01ac5613cf72e06976ae2da58cf SHA-1: 2f34beb52b1e5ccf03a5e919795b860127a74220 SHA-256: 0fd6ff892176b9c183860fc2d7502ae47d84e667ba47f865de3f102b52b7cf26
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded links, a technique often used for SEO manipulation or to redirect users to malicious sites. ClamAV detected this as 'Pdf.Phishing.TtraffRobotInstall-7605656-0', indicating a phishing or traffic redirection purpose. The ML classifier also strongly flagged it as malicious. No scripts were extracted, but the sheer volume of external links suggests a malicious intent to lure or redirect.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.mindfulofjiujitsu.com/uploads/1/3/0/5/130551341/kopofiru-zedota-fafamadafisepi.pdf
    • http://www.theparentingbrochure.com/uploads/1/3/0/3/130313513/xosagivud_situbu.pdf
    • http://toddlerdisciplineapp.com/uploads/1/3/0/5/130551457/ropewaxive.pdf
    • http://www.heatflowsolutions.co.uk/uploads/1/3/0/3/130323518/2652516.pdf
    • http://sunsetsailkeywest.net/uploads/1/3/0/8/130814143/dukizoru.pdf
    • http://mail.cameo-cleaning.com/uploads/1/3/0/2/130288751/ec9f2.pdf
    • http://www.pianoteshawaii.com/uploads/1/3/0/7/130738993/nudijidozugi_javog.pdf
    • http://hostmaster.gaplanex.net/uploads/1/3/0/7/130776102/7677570.pdf
    • http://www.pipsqueakacademy.com/uploads/1/3/0/5/130551429/domivelowerukir.pdf
    • http://miami.momotombochocolatefactory.com/uploads/1/3/0/4/130476298/faba8.pdf
    • http://desatascosbadalona.net/uploads/1/3/0/6/130620614/lomififufu-bezivawege.pdf
    • http://www.fikachennai.com/uploads/1/3/0/7/130739129/famafekinig-vatibonadefopes-falelapexizukod.pdf
    • http://breimhurst.com/uploads/1/3/0/6/130639873/jawatud_jusuzefi_jelolukadapal_rowoxuj.pdf
    • http://www.thematstudionj.com/uploads/1/3/0/3/130379380/d453a415fed.pdf
    • http://millhouseconsultants.com/uploads/1/3/0/6/130603676/3d4fdeeee.pdf
    • http://el035.elrepco.com/uploads/1/3/0/2/130287367/aaddffa88.pdf
    • http://ceresevents.org/uploads/1/3/0/2/130272552/piwul.pdf
    • http://partnerfirstfinancial.com/uploads/1/3/0/6/130605471/9400077.pdf
    • http://www.orrsomebling.com/uploads/1/3/0/6/130621273/130621273.html#adding+and+subtracting+fractions+with+like+denominators+worksheets+with+pictures

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000474d.bin
3672fad21db602b6aa790e1067152438c18fd9e32d1d4a5bfb1794b49d008e57		 pdf-font-stream PDF embedded font (sfnt) at offset 0x474D 7680 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.