Malicious PDF — malware analysis report

Static analysis result for SHA-256 35ba8fc2990c308d…

MALICIOUS

PDF

47.9 KB Authoring application: pdf-parser
MD5: 2d903aad4761fe4964c832c34f8b36ad SHA-1: 023fa5602ece802f5c720fbec10b7cab35a63524 SHA-256: 35ba8fc2990c308d41185725a2b0d8b318b4fc90b579a0ed339efbe47fb8c3dc
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file was flagged by multiple heuristics, including a critical PDF_SEO_LINK_FARM rule and ClamAV detection as Pdf.Phishing.TtraffRobotInstall. The presence of 31 external links, many pointing to suspicious domains, strongly suggests a phishing or malware distribution attempt. The document body contains a large number of these URLs, reinforcing the link farm attack pattern.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://taleti.pinhs-ap.com/uploads/2020/01/29/6715483.pdf
    • http://stevejager.com/uploads/1/3/0/2/130270918/rarusoxo-vizurowivir.pdf
    • http://aaadentalbahamas.com/uploads/1/3/0/2/130272281/3502356.pdf
    • https://kijopaleroju.weebly.com/uploads/1/3/0/4/130435839/7106192.pdf
    • http://noblocky.com/uploads/1/3/0/5/130542971/kegokuwagawete-tonemoni-vufazedos.pdf
    • http://decommissioninggom.offsnetevents.com/uploads/1/3/0/6/130605355/mopapunil.pdf
    • http://norwoodhighschool.net/uploads/1/3/0/2/130287502/3b8258fb2c5.pdf
    • http://elliemaysgrowingupridgeback.com/uploads/1/3/0/6/130603937/gemadegixifonuwifiki.pdf
    • http://mstvirginhair.com/uploads/1/3/0/3/130323934/6353293.pdf
    • http://tim.zonaspasalon.ru/uploads/2020/01/28/893cb718d18ddd1.pdf
    • http://dedicatedladiesconcrete.com/uploads/1/3/0/3/130323190/narajija.pdf
    • http://novamedia.dk/uploads/1/3/0/4/130488198/bamuxodoxedo.pdf
    • http://srglasswarehouse.com/uploads/1/3/0/6/130604678/9fb6369b2.pdf
    • http://somersetfoodtrail.org/uploads/1/3/0/4/130436426/zenan.pdf
    • http://myelizabethsanchez.com/uploads/1/3/0/2/130292098/9974014d80c60.pdf
    • http://emilylimes.com/uploads/1/3/0/2/130287504/dowisaxepe.pdf
    • http://moreministries.info/uploads/1/3/0/5/130539235/c2863a48.pdf
    • http://stikitiki.fun/uploads/2020/01/29/490387.pdf
    • http://10dayfilm.org/uploads/1/3/0/4/130483766/vizep_lajowitudomado_bisugupuwo_vokirezawojuvoj.pdf
    • http://bipazumo.sardelas.ru/uploads/2020/01/28/dd69e.pdf
    • http://fowudi.stroymarketmetal.ru/uploads/2020/01/28/9264833.pdf
    • http://dalal.la/uploads/1/3/0/5/130539113/3b1b11b727e.pdf
    • https://difofiwirav.weebly.com/uploads/1/3/0/5/130539229/vujefos.pdf
    • http://mooderopah.co.uk/uploads/1/3/0/5/130588845/zepogotuloxilozerovi.pdf
    • http://famefula.lechenienarkomanii-ivanovo.ru/uploads/2020/01/28/4d12175.pdf
    • http://reboundat.com/uploads/1/3/0/5/130590525/130590525.html#angular+disable+button+reactive+form

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00000f80.bin
25c3663dd496f098c4d2d829f66da1a5682c809921f050845e3cf37ce82a2cee		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF80 8472 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.