Malicious PDF — malware analysis report

Static analysis result for SHA-256 3a65822e8af07609…

MALICIOUS

PDF

40.6 KB Authoring application: PDFedit
MD5: a75831dfcc9ee4d0a76b5b3a97771bd8 SHA-1: 403908b48a2218d9df47b7a18b7b549992defc29 SHA-256: 3a65822e8af07609cc8c90e914d85a4ab0a9c9e163e6cb06ecbfbe7136e15666
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file was flagged by multiple heuristics, including ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and a critical PDF_SEO_LINK_FARM alert. The document body contains a large number of embedded URLs, suggesting a link farm designed to redirect users to malicious content. The primary function appears to be a phishing or traffic redirection scheme.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://7ranch.org/uploads/1/3/0/5/130588151/8737123.pdf
    • http://doublettango.com/uploads/1/3/0/2/130270987/5563476.pdf
    • http://wikusun.itmaster-pro.ru/uploads/2020/01/28/fator_xixebatu.pdf
    • http://shaohuawu.com/uploads/1/3/0/5/130544257/bf3af10d.pdf
    • http://market-lm.com/uploads/2020/01/27/765a2.pdf
    • http://fabalove.com/uploads/1/3/0/4/130435794/xajowi_lorejitovudoj.pdf
    • http://hearchrisvosters.com/uploads/1/3/0/6/130605168/sizafupemevis.pdf
    • http://mountainreveriemassage.com/uploads/1/3/0/5/130588554/7239519.pdf
    • http://tedim.mymobiledriver.com/uploads/2020/01/27/3966084.pdf
    • http://phgadgetpagadian.com/uploads/2020/01/28/tawepalodowo.pdf
    • http://1itnoj.org/uploads/1/3/0/6/130620760/cbd37a285dac4.pdf
    • http://gitulometi.audiostart09.icu/uploads/2020/01/27/94318.pdf
    • http://noduguvadu.fastforcash.xyz/uploads/2020/01/27/bepakazagozagodemil.pdf
    • http://assetskill.com/uploads/1/3/0/2/130272921/fupagoluvu.pdf
    • http://12acresfarm.ca/uploads/1/3/0/5/130544078/5d404.pdf
    • http://sunrisefoundationforwomen.com/uploads/1/3/0/6/130605471/jetalalesew.pdf
    • http://rachkonline.com/uploads/1/3/0/2/130289421/6c4cb9.pdf
    • http://strahovanie61.ru/uploads/2020/01/27/b52b1d22d254.pdf
    • http://zunubu.cloudycherry.net/uploads/2020/01/29/1742226.pdf
    • http://lapoguzoxe.sardelas.ru/uploads/2020/01/29/pebesajakumile_bunuwozejeraw_jivexamisilubad_zafidigolaso.pdf
    • http://thelittlethingsonline.com/uploads/1/3/0/6/130639734/5ed9923d2ca593d.pdf
    • http://pil.svyazexpo-online.ru/uploads/2020/01/29/2309382.pdf
    • https://dajuxamadodal.weebly.com/uploads/1/3/0/6/130605387/verubojalofojeketu.pdf
    • http://gufege.ip-i.ru/uploads/2020/01/28/delavom.pdf
    • http://tcsonline.net/uploads/1/3/0/6/130620150/130620150.html#html+website+er+free

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001730.bin
f724eee82952a2297c1c4964689a76f8bfd7f4367d85e57fd3de8ba4efc0c8bb		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1730 9240 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.