Malicious PDF — malware analysis report

Static analysis result for SHA-256 1949631c621bcd5f…

MALICIOUS

PDF

41.8 KB Authoring application: PDFedit
MD5: b441281fb0cf7081a6621bb0cb11f0ee SHA-1: 819fa4752cda179ebda70496f56b61b37c619a57 SHA-256: 1949631c621bcd5f056cc80895b5a14cd9629c913c57344fe91e5fed08969f31
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains a large number of embedded URLs pointing to other PDF files, a technique often used for SEO manipulation or to distribute further malicious content. The ML classifier and ClamAV detection strongly indicate malicious intent, specifically identified as phishing or a robot installer. While no scripts were explicitly extracted, the embedded URLs themselves serve as the primary indicators of compromise.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://calhounheritagep.com/uploads/1/3/0/6/130639110/e78ec610fbd4.pdf
    • http://guwatenu.asdhqwas.icu/uploads/2020/01/28/sobodeleni.pdf
    • http://myanmardiscover.com/uploads/1/3/0/5/130546486/5743015.pdf
    • http://bswheadworks.com/uploads/1/3/0/6/130603676/3383874.pdf
    • http://raganiv.serovatextile.ru/uploads/2020/01/28/5304042.pdf
    • http://koinoniaatclarion.net/uploads/1/3/0/5/130588586/mixewide.pdf
    • http://liromidimi.delofty-official.com/uploads/2020/01/29/kezilorijewi.pdf
    • http://treeservicessc.com/uploads/1/3/0/5/130590658/9f6e72bd87.pdf
    • http://skfinancieel.nl/uploads/1/3/0/5/130551746/xaxed-doterimutoro.pdf
    • http://azarenkosergey.com/uploads/2020/01/29/mosamovipokiwef.pdf
    • http://designsthatflow.com/uploads/1/3/0/4/130488578/7085dbf459.pdf
    • http://myflorapops.com/uploads/1/3/0/4/130483138/6b6e9c51a472041.pdf
    • http://amanziqs.co.za/uploads/1/3/0/5/130551299/3347755.pdf
    • http://puredogbreedregistry.com/uploads/1/3/0/2/130288301/najajoxebewigamo.pdf
    • https://fomivipapatoba.weebly.com/uploads/1/3/0/2/130289693/kobuzufuvan-jubare-gelobiriz.pdf
    • http://wigapal.magaz-online18.ru/uploads/2020/01/28/5fa237.pdf
    • http://nofap.ilikepizza.ru/uploads/2020/01/27/7708260.pdf
    • https://dokinewizoz.weebly.com/uploads/1/3/0/4/130490006/8448887.pdf
    • http://mixijoz.kuhni-msc10.icu/uploads/2020/01/27/612c7efae0df.pdf
    • http://beraginuta.syndicat.club/uploads/2020/01/28/7341412.pdf
    • http://diamondbathrooms.org/uploads/1/3/0/2/130274316/kikokagog-gegit.pdf
    • http://audiostart07.icu/uploads/2020/01/27/risuxinasigeru.pdf
    • http://somersetfoodtrail.org/uploads/1/3/0/6/130604088/130604088.html#spelling+worksheets+for+grade+2

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000017ca.bin
68dcfbac624a3bd600ccf0ee4c6bd4b3ac8e4d6a26ec4bfbe998abde1534e380		 pdf-font-stream PDF embedded font (sfnt) at offset 0x17CA 7728 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.