Malicious PDF — malware analysis report

Static analysis result for SHA-256 2df01074173844ee…

MALICIOUS

PDF

39.3 KB Authoring application: GIMP
MD5: db1dba873ff67ac9e45657699fb03532 SHA-1: c2f8f05d62e95d4febcbf133ff72dd11fbc16412 SHA-256: 2df01074173844ee7d2ce1809133c6c9aeb57a95088c069dbc50dc007a147ad8
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was identified as malicious by ML classification and ClamAV, which flagged it as 'Pdf.Phishing.TtraffRobotInstall-7605656-0'. Static analysis revealed a large number of embedded external links, indicating a link farm designed to redirect users to potentially harmful content. The document body contains garbled text and unrelated phrases, suggesting it is not intended for legitimate user interaction but rather as a container for these malicious links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://nesoinc.com/uploads/1/3/0/2/130287920/191902.pdf
    • http://vallavakili.net/uploads/1/3/0/6/130620417/8999567.pdf
    • http://westsideyogatherapy.com/uploads/1/3/0/8/130813518/3274615.pdf
    • http://cbacreditcard.com/uploads/1/3/0/5/130546971/fupokelejoginujo.pdf
    • http://miaaindustries.com/uploads/1/3/0/6/130621128/165e0a89f42db92.pdf
    • http://baytownhydroax.com/uploads/1/3/0/5/130588650/pidesenobepuso.pdf
    • http://sikhsource.com/uploads/1/3/0/6/130604805/dopemepubujenot-lusasip-ferexal.pdf
    • http://my4health.com/uploads/1/3/0/7/130740133/dizugem_kulozunavak_rupudakali.pdf
    • http://onlinefitnessunderground.com/uploads/1/3/0/3/130313624/6889742.pdf
    • http://artsphynx.com/uploads/1/3/0/5/130538836/getulaxenovise-bonej-bikajabiwe.pdf
    • http://kadydunlapprints.com/uploads/1/3/0/7/130740497/rulaguwekel.pdf
    • http://hardwarebridge.com/uploads/1/3/0/8/130873794/wawebokezimemav-nesilobe-vobunavagexipez.pdf
    • http://www.theadmissionssherpa.com/uploads/1/3/0/5/130588277/8e7a9b1.pdf
    • http://customerwise.co/uploads/1/3/0/3/130324331/7e2a5009d91a0.pdf
    • http://electjimsnyder.com/uploads/1/3/0/4/130488295/ad32f8cbcf.pdf
    • http://socalboys.com/uploads/1/3/0/6/130604560/samudafosedub.pdf
    • http://www.conciehrge.com/uploads/1/3/0/6/130621371/6188784.pdf
    • http://suredoneservices.com/uploads/1/3/0/5/130590391/telakadijizipo_rumamavufi_kujivusewirawo.pdf
    • http://lingeriestoresdallas.net/uploads/1/3/0/7/130739828/tevesenixa-sajinigegoto-duropatev.pdf
    • http://blitzfund.us/uploads/1/3/0/8/130874522/gedaxu_jivaliv_negiwap_tegamiga.pdf
    • http://yinghunzuanshi.br3h.com/uploads/1/3/0/5/130588497/130588497.html#igcse+biology+paper+2+june+2018
    • http://lingeriestoresdallas.net/uploads/1/3/0/7/130739828/tevesenixa-sajinigegoto-duro

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002e2b.bin
83459e82cebe561b9e65dda6a09953c9e35f75e5df0fa62a624e1833cc5b8086		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2E2B 1708 bytes
font_01_sfnt_off0000393c.bin
f6cfa86c42f0eaab62776aa8054f079ea6b8113b0da606bd510150ab719459a0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x393C 7912 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.