Malicious PDF — malware analysis report

Static analysis result for SHA-256 15fc5f3c299adcea…

MALICIOUS

PDF

35.1 KB Authoring application: pdf-parser
MD5: fd77204a030b4a407cb6c482abf2977c SHA-1: 934e4e2cd0982cb98fa5e0ed5a8d952232bc9b43 SHA-256: 15fc5f3c299adcea8ab35d8a9b02346f1fcdb26a0b424dcda3808b1207f7b6a3
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded URLs pointing to external PDF files, indicative of a link farm or a distribution mechanism for further malicious content. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the ML classifier strongly suggest malicious intent, likely related to phishing or traffic redirection. No scripts were extracted, but the sheer volume of linked PDFs suggests a coordinated effort to direct users to potentially harmful sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://sports-physio-online.com/uploads/1/3/0/2/130291523/07f86c4ab.pdf
    • http://mojiles.net/uploads/1/3/0/6/130621031/2245828.pdf
    • http://vudumedia.net/uploads/1/3/0/5/130588675/6389697.pdf
    • http://magicfoodbus.org/uploads/1/3/0/5/130538986/kupovoridepafe_gerisajirebuge.pdf
    • http://ownyourlinemtb.com/uploads/1/3/0/5/130546519/8282729.pdf
    • http://coreducate.com/uploads/1/3/0/4/130488432/3cf75217ffbd.pdf
    • http://rudingantengdarilahir.com/uploads/1/3/0/4/130477135/refisef.pdf
    • http://northshorelemonade.com/uploads/1/3/0/3/130324385/483972.pdf
    • http://johnwesleyhardin.it/uploads/1/3/0/2/130274024/9611207.pdf
    • http://caninecocktailpawty.com/uploads/1/3/0/5/130550967/7286242.pdf
    • http://mestizostacos.com/uploads/1/3/0/3/130323564/vapilomejup_kiwogixefij_texifolixuti.pdf
    • http://tonatedu.glavmontag.com/uploads/2020/01/28/tokudoxutipuwapuw.pdf
    • http://riversidecountyhistory.org/uploads/1/3/0/8/130814706/130814706.html#free+volleyball+roster+and+lineup+sheets+printable

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001311.bin
52bb59d4ac69bfdfa6a39a80bb7bcf05374988af902360a9c28645cb6f7ec034		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1311 7932 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.