Malicious PDF — malware analysis report

Static analysis result for SHA-256 17957797991990b3…

MALICIOUS

PDF

52.0 KB Authoring application: Solid Converter PDF
MD5: 5bd634a5e2d8d75a5d9bd76ad537037a SHA-1: 05f00e3e573613f4e051b9f101e9e575bf55358d SHA-256: 17957797991990b3537bad6be5f6d9c389abafb34419dca403d90e33c39ab0d4
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF document contains a large number of embedded URLs pointing to other PDF files, a technique often used for SEO manipulation or to distribute malicious content. ClamAV detected this file as 'Pdf.Phishing.TtraffRobotInstall-7605656-0', and a machine learning classifier also flagged it as malicious with high confidence. The embedded URLs are the primary indicators of malicious activity, suggesting a phishing or content distribution scheme.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://jeffersonhigh.net/uploads/1/3/0/5/130588289/1758585.pdf
    • http://nethanelhunting.co.za/uploads/1/3/0/3/130324030/ab02e0c.pdf
    • http://nadiacorson.com/uploads/1/3/0/4/130436494/9553305.pdf
    • http://knit1chicago.com/uploads/1/3/0/6/130620522/9c84132a9e51.pdf
    • http://guzozogub.party.su/uploads/2020/01/28/380bd955.pdf
    • http://cufftie.com/uploads/1/3/0/6/130639552/pibitokalan.pdf
    • http://adultgleeclubaustralia.com/uploads/1/3/0/5/130551208/zasotomixezewaza.pdf
    • http://vhcministry.org/uploads/1/3/0/2/130288875/gikakerivokizivor.pdf
    • http://newinsightfss.org/uploads/1/3/0/6/130605420/2088298.pdf
    • http://nursingarmpillow.com/uploads/1/3/0/2/130289563/130289563.html#vertical+axis+wind+turbine+kit

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00000fb8.bin
e0a46e6398f20ee41b15f178c3ceeac63f5bfb34913c3fcecbf8b9361e743ebe		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFB8 9364 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.