Malicious PDF — malware analysis report

Static analysis result for SHA-256 361646943e2c5e15…

MALICIOUS

PDF

36.9 KB Authoring application: Pdftk
MD5: f1aaa365a4718c0ca44229df2af9a87c SHA-1: cba77742f1522c8cfb6395e68ee5e25c3adaf2af SHA-256: 361646943e2c5e15c362bd4008bc0d11daab11af2c3f70cf86acd7141bea0792
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded external links, identified as a PDF_SEO_LINK_FARM heuristic. This suggests the document's primary purpose is to redirect users to a multitude of other PDF files hosted on various domains. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a malicious intent, likely related to phishing or traffic redirection. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://crankshaftmotorcarclub.com/uploads/1/3/0/5/130589371/xuxas-gixawi-bipuwites-dixatiduzuzar.pdf
    • http://luc-id.net/uploads/1/3/0/5/130542968/e1077b.pdf
    • http://kimgustafson.net/uploads/1/3/0/6/130604180/zenanaselini-zorodojonukitip-rufedixa-majudanujuwir.pdf
    • http://xoxotaylornichole.com/uploads/1/3/0/4/130476736/7844079.pdf
    • http://mymathtutoring.com/uploads/1/3/0/3/130379741/9005278.pdf
    • http://hollandghanaplatform.net/uploads/1/3/0/3/130379428/7be5111fc494cf.pdf
    • http://cbconservation.com/uploads/1/3/0/4/130490915/3644571.pdf
    • http://myrole.legal/uploads/1/3/0/5/130589409/713a05837.pdf
    • http://alexandriafamilymartialarts.com/uploads/1/3/0/5/130588606/rewufosukabomilut.pdf
    • http://missionhere.org/uploads/1/3/0/5/130550938/miwejiniripemo.pdf

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000129f.bin
8c307a24db9cb765319b6f40c418d34b9fd6c37f62d65d0f088ea766d03976ea		 pdf-font-stream PDF embedded font (sfnt) at offset 0x129F 7980 bytes
font_01_sfnt_off00005a33.bin
987ec97538a18e84a7e1e47f5ba460142673cacfaedf4915f9fddbfd4a61cf9c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5A33 4248 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.