Malicious PDF — malware analysis report

Static analysis result for SHA-256 111d7e0cdc3a1cb4…

MALICIOUS

PDF

52.8 KB Authoring application: PDFBox
MD5: 9c51a0f069586d5cb5ea07ac513e14f0 SHA-1: 97c3fa8a683a3b8970e1e265cc538f00a01e3142 SHA-256: 111d7e0cdc3a1cb4086d4cf571dc902d539bde2ac781ec15c5e9506305ffc25b
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of embedded external links, a technique often used for SEO spam or to redirect users to malicious sites. ClamAV detected this as 'Pdf.Phishing.TtraffRobotInstall-7605656-0', indicating a phishing or traffic redirection purpose. The ML classifier also strongly flagged it as malicious. While no scripts were explicitly extracted, the nature of the link farm suggests a potential for JavaScript execution or further malicious content delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9899

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://chrisreidstudio.net/uploads/1/3/0/4/130436074/12ffcad.pdf
    • http://beingdance.com/uploads/1/3/0/2/130289365/1523393.pdf
    • http://triptexts.com/uploads/1/3/0/2/130270768/584a0.pdf
    • http://bdcglobalpng.com/uploads/1/3/0/6/130639701/5202378.pdf
    • https://benosatini.weebly.com/uploads/1/3/0/5/130547116/gomiduzopusubiw.pdf
    • http://curtisneuman.com/uploads/1/3/0/5/130538918/3354580.pdf
    • http://studio8sound.com/uploads/1/3/0/5/130588579/felajodobogit.pdf
    • http://readwritebake.com/uploads/1/3/0/5/130539002/1025fd5.pdf
    • http://woodlandstuition.com/uploads/1/3/0/2/130287279/130287279.html#business+words+list+with+meaning+pdf
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000459c.bin
2f27c6ae9b19c3c4d91a30722f889239248f0b07016f39e838ba4134cf82d74e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x459C 8468 bytes
font_01_sfnt_off00008d41.bin
677e71428f97d697e1d37b94920902cc1f79d6c40420e53eae369df573da2ac3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8D41 16192 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.