Malicious PDF — malware analysis report

Static analysis result for SHA-256 360e7802d2fed0ad…

MALICIOUS

PDF

66.2 KB Authoring application: Poppler-utils
MD5: e618b8b0e45938fd9cf14439490a5cf3 SHA-1: 3ce09b753fb1682632023ba45650849d95e206e8 SHA-256: 360e7802d2fed0ad838d78da7193ca84274058c659ee9f06fcb698abf07ea124
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was flagged by multiple heuristics, including a critical PDF_SEO_LINK_FARM rule and ClamAV detection as Pdf.Phishing.TtraffRobotInstall-7605656-0. The embedded URL structure and the sheer number of external links strongly suggest a phishing or malware distribution campaign. The document body contains corrupted text, indicating it is not intended for legitimate user interaction.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.webcamthong.com/uploads/1/3/0/5/130551775/kenojet_wewiwuk_namilil.pdf
    • http://naturalmusicmarketing.net/uploads/1/3/0/3/130323097/6372180.pdf
    • http://oliveandash.ca/uploads/1/3/0/5/130588438/5783161.pdf
    • http://byshannonmalone.com/uploads/1/3/0/4/130483354/77a6a40250.pdf
    • http://mta-sts.mail.wedorecyclinginsurance.com/uploads/1/3/0/7/130775278/3043828.pdf
    • http://stephenshooster.com/uploads/1/3/0/3/130313177/d94dec.pdf
    • http://minimalwaste.net/uploads/1/3/0/6/130604938/pewedupokegob.pdf
    • http://mariageronimo.com/uploads/1/3/0/7/130739575/bd0526a8.pdf
    • http://midwestgastronome.com/uploads/1/3/0/2/130272600/jifuvise.pdf
    • http://mrscarasclass.com/uploads/1/3/0/6/130639661/nulekomaweb-fitox-julani.pdf
    • http://search.canustrealtyinc.com/uploads/1/3/0/6/130605292/sebevuxelob.pdf
    • http://xfdainspector.com/uploads/1/3/0/5/130588870/456efe02953f872.pdf
    • http://houstonasta.voyagerwebsites.com/uploads/1/3/0/9/130969905/130969905.html#uric+acid+normal+value+in+female

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001283.bin
baf78567f62b8dc4036c35bb2b7818f750b3177bb89ea81799ecc688df4567e0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1283 10268 bytes
font_01_sfnt_off0000b5fb.bin
5799fb81e261f6dd50ff9b503e85c44e438542e2bf8c8893756d066a073750d7		 pdf-font-stream PDF embedded font (sfnt) at offset 0xB5FB 6496 bytes
font_02_sfnt_off0000c5a2.bin
cd5b04feeae1aab24d32ec675b888b21b71c4a17e467ce630bfa86e07139397e		 pdf-font-stream PDF embedded font (sfnt) at offset 0xC5A2 2704 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.