Malicious PDF — malware analysis report

Static analysis result for SHA-256 2ac5adee347348cb…

MALICIOUS

PDF

44.8 KB Authoring application: Smallpdf Desktop
MD5: 35028d35856f97eee59578ea14edb783 SHA-1: 2bbab4ade59aafe4f6b9c16e5169aeb2ad1465f8 SHA-256: 2ac5adee347348cb278cbca47efbdf8aa838a0dda19e5a082ad397e04c4e2e54
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of external links, identified as a 'PDF_SEO_LINK_FARM' heuristic. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the ML classifier output strongly indicate malicious intent. The primary attack pattern involves directing users to a domain ('tamils.directory') that hosts numerous other PDF files, likely for SEO manipulation or to serve malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://tamils.directory/uploads/1/3/0/2/130272233/e1c87b8a.pdf
    • http://aviationcarbonevents.com/uploads/1/3/0/5/130589322/842248.pdf
    • http://www.unbearablelightnessofbeing.com/uploads/1/3/0/3/130323979/df8f7d1.pdf
    • http://www.potentialromanticrelationships.com/uploads/1/3/0/4/130436121/satuzinosepil-kerumato.pdf
    • http://bars4bitcoin.com/uploads/1/3/0/7/130776572/2842412.pdf
    • http://panspermia.net/uploads/1/3/0/6/130620763/4293344.pdf
    • http://ericdietrich.com/uploads/1/3/0/4/130435717/2739560.pdf
    • http://ngpsychology.com/uploads/1/3/0/6/130620429/9840843.pdf
    • http://learnthebibleinayear.net/uploads/1/3/0/7/130775612/9eb90a9.pdf
    • http://nurturebabies.net/uploads/1/3/0/6/130640116/rulukemipipa-nomukemixofap-luribitijobaze-potogefazisokel.pdf
    • http://horncomb.com/uploads/1/3/0/3/130313826/geporaf.pdf
    • http://www.readingcampinhuntington.org/uploads/1/3/0/6/130640006/gudikulovivomakonig.pdf
    • http://shotgunhillbilly.com/uploads/1/3/0/2/130272934/27107fca20f.pdf
    • http://featheredshoppe.com/uploads/1/3/0/8/130814219/4915580.pdf
    • http://nokr.nl/uploads/1/3/0/8/130814360/19af321271b0ac8.pdf
    • http://mingcamellia.com/uploads/1/3/0/7/130740498/4487657.pdf
    • http://hilleke.info/uploads/1/3/0/6/130604568/d6c80b0d40d7d4.pdf
    • http://mrsdsmithsthirdgrade.com/uploads/1/3/0/6/130621495/solufili_remavexime_mezifusoraji.pdf
    • http://adventureinstincts.com/uploads/1/3/0/4/130477945/130477945.html#learned+adjective+definition

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003480.bin
2e1aa5e687354d5e196079d334aba123dd57f6129a9bb0b428af656cc7b1e960		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3480 16456 bytes
font_01_sfnt_off00004e14.bin
93f0d49431a6066f37df5821a73864f2ff7fcf804f01ec9d38eab48d6efde814		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4E14 9320 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.