Malicious PDF — malware analysis report

Static analysis result for SHA-256 162f05c138c4f639…

MALICIOUS

PDF

35.6 KB Authoring application: pstoedit
MD5: bc9ce03b9d64db9590fd2be529805085 SHA-1: 31ecb511c4f1ad112bc8d9d4e1da1987bf73dc42 SHA-256: 162f05c138c4f639f9a3038626e6a06b9656f156fe1a367afd405c493f2e4ec0
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic, pointing to other PDF files. This suggests a tactic to manipulate search engine results or distribute malicious content. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a malicious intent, likely related to phishing or traffic redirection.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://datadriventutoring.org/uploads/1/3/0/6/130604770/65245968132.pdf
    • http://alstart.co.uk/uploads/1/3/0/6/130620973/jakinerexowew-vosad.pdf
    • http://extremeautoservice.us/uploads/1/3/0/2/130272603/jusije-kilunijoxas-gulilogaladaw.pdf
    • http://napervillecarpetclean.com/uploads/1/3/0/7/130739479/7602641.pdf
    • http://edgemereestatesfarm.com/uploads/1/3/0/5/130589037/nokikidude-rorev-wokebug-sobumejatawo.pdf
    • http://www.2amepiphany.com/uploads/1/3/0/6/130621131/zuvuxa.pdf
    • http://sophietang.com/uploads/1/3/0/6/130603832/2623153.pdf
    • http://greenbraintechs.com/uploads/1/3/0/4/130476372/mosevi.pdf
    • http://champastreet.com/uploads/1/3/0/5/130589000/sijubijixidi.pdf
    • http://vaginasteam.net/uploads/1/3/0/4/130478203/jixosomaro.pdf
    • http://rotoruayachting.club/uploads/1/3/0/5/130588803/bominidadef-xozililisa-manadutejuwil-gezelimugexazuf.pdf
    • http://modelcitizenrecords.co.uk/uploads/1/3/0/5/130588668/dasexojogu-tetomebudalo-jebivetibolod.pdf
    • http://shopfounders.com/uploads/1/3/0/6/130639744/zexiwirew.pdf
    • http://marielouisewarren.co.uk/uploads/1/3/0/5/130551708/nemizorazu.pdf
    • http://railandrivermarket.com/uploads/1/3/0/4/130478551/2f8a26b14b.pdf
    • http://lamee-dark-version3-de.devsite-1.com/uploads/1/3/0/6/130605230/130605230.html#genero+lirico+origen+pdf

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000301c.bin
a284415cffdf618132fbce003d0138116f11510b4c878816ca8d05ba23be177b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x301C 8476 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.