Malicious PDF — malware analysis report

Static analysis result for SHA-256 3687b39065e619cf…

MALICIOUS

PDF

70.6 KB Authoring application: PDFBox
MD5: e29aa0ae11461a7a2bcea7289f4bd381 SHA-1: 320452887d05c6b0345484271f3720b6837c885a SHA-256: 3687b39065e619cfc35c831531ffc453b5736ae6a43ec79f1aa9a1433fc868ef
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file was flagged by multiple heuristics, including a critical finding for a 'PDF_SEO_LINK_FARM' and ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0'. The document body contains a large number of embedded URLs, all pointing to external PDF files hosted on various domains. This indicates a likely phishing or malware distribution attempt, where the links are designed to lure users to potentially malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.thewanderingjojo.com/uploads/1/3/0/6/130620619/8299f.pdf
    • http://norfolkeventmedicalservices.com/uploads/1/3/0/5/130589435/gijodadeseje_mitasezax.pdf
    • http://janewagman.com/uploads/1/3/0/7/130740019/lipuvodewudul.pdf
    • http://webdisk.jeremymahood.com/uploads/1/3/0/6/130621245/69894e4d.pdf
    • http://meetthebeetles.info/uploads/1/3/0/5/130551206/cc3d3a.pdf
    • http://mikevaproduction.com/uploads/1/3/0/7/130740483/5805759.pdf
    • http://landernv.net/uploads/1/3/0/5/130589064/riruvuwigadetiz-somuginemugo-letefi.pdf
    • http://www.afhtranslationservice.com/uploads/1/3/0/7/130776078/liziz.pdf
    • http://orbum.org/uploads/1/3/0/2/130273616/d88dbdd1a.pdf
    • http://neotrainehr.com/uploads/1/3/0/4/130489185/lubop-zerez.pdf
    • http://afternooncatnap.com/uploads/1/3/0/4/130435661/mabasawoxajo_fadunixoripu_nikinovume.pdf
    • http://porqueeseidiotasevetanbienyyono.com/uploads/1/3/0/9/130969131/13bfe8323.pdf
    • http://muktishakti.com/uploads/1/3/0/4/130483158/9947888.pdf
    • http://sherwoodduplex.com/uploads/1/3/0/5/130590215/7159452.pdf
    • http://host119.carmichaelnl.com/uploads/1/3/0/4/130483146/130483146.html#tratamento+fisioterapeutico+para+hernia+de+disco+cervical+pdf

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002c36.bin
94358d3145338ecd7f04861271a7588408be5b8be02e2f0e33efceff10d57bf4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2C36 11712 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.