Malicious PDF — malware analysis report

Static analysis result for SHA-256 2dc1869d0b0e03a9…

MALICIOUS

PDF

37.0 KB Authoring application: Smallpdf Desktop
MD5: c05e25d0c0906cd2b84efa4031985938 SHA-1: 83e24083efcae3c7a20a1f05a566aaf79f714526 SHA-256: 2dc1869d0b0e03a99aeb9d4a8ca18123126fb734cc63f97af638c22a8d5124d1
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded external links, identified as a PDF_SEO_LINK_FARM heuristic. The ML classifier and ClamAV also flagged this file as malicious, with ClamAV specifically identifying it as Pdf.Phishing.TtraffRobotInstall-7605656-0. The primary attack pattern appears to be directing users to a network of malicious PDF files hosted on various domains, likely for SEO poisoning or to serve as a distribution point for further malware.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://smartmoves.info/uploads/1/3/0/4/130483631/fajisawigamerorop.pdf
    • http://jordanlosesweight.com/uploads/1/3/0/7/130738578/7402944.pdf
    • http://planetsubtexas.com/uploads/1/3/0/7/130738720/1d07fdad6f.pdf
    • http://sugarpaso.com/uploads/1/3/0/4/130489706/4f42bb197e7.pdf
    • http://nchuntlumber.net/uploads/1/3/0/7/130739456/7504190.pdf
    • http://mrnice420.com/uploads/1/3/0/2/130287852/jadajaw.pdf
    • http://cristofori.online/uploads/1/3/0/7/130738647/2016926.pdf
    • http://skicave.com/uploads/1/3/0/3/130323972/likev_pomonav_luviko.pdf
    • http://duganspecialties.com/uploads/1/3/0/5/130546392/2f957d2cf2.pdf
    • http://trainingcenterchurches.net/uploads/1/3/0/6/130604517/wujinuzabi.pdf
    • http://integraldreaming.org/uploads/1/3/0/3/130313306/dekudowomapuvawonasi.pdf
    • http://longwoodhomesforsale.net/uploads/1/3/0/6/130620973/ff15479420c80.pdf
    • http://agslist.com/uploads/1/3/0/4/130476152/belen.pdf
    • http://ictforpeace.com/uploads/1/3/0/6/130621591/3914094.pdf
    • http://solectwokamienica.pl/uploads/1/3/0/5/130544811/4072958.pdf
    • http://mrrotdir.com/uploads/1/3/0/5/130540642/kiberope.pdf
    • http://room212productions.com/uploads/1/3/0/6/130639334/5157134.pdf
    • http://sensaur.com/uploads/1/3/0/6/130604516/zinorukakilun-boropiteman-dakobipazuf.pdf
    • http://bartolomeilaw.com/uploads/1/3/0/3/130379174/130379174.html#best+lower+ab+workout+after+c-section
    • http://skicave.com/uploads/1/3/0/3/130323972/likev_

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000034c0.bin
870a8327d82f6c004f271d656fc3a7fa9070c04b3be0b48327d5c101985515eb		 pdf-font-stream PDF embedded font (sfnt) at offset 0x34C0 7424 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.