Malicious PDF — malware analysis report

Static analysis result for SHA-256 429ccdf3b57f4e91…

MALICIOUS

PDF

40.2 KB Authoring application: PDFedit
MD5: f2ead0d1539e7d48dfb535caf1236c9d SHA-1: 1273929250d07a3c836af8c674aa9e32cec83c18 SHA-256: 429ccdf3b57f4e9188bac9ef36500fba2e2ec10e7268441063ce64e8452551dd
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF contains a large number of embedded links to external PDF files, a technique commonly used for SEO poisoning and phishing. ClamAV detected this as Pdf.Phishing.TtraffRobotInstall-7605656-0, and a machine learning classifier also flagged it as malicious. The embedded links likely lead to further malicious content or phishing pages.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://amandamckelt.com/uploads/1/3/0/4/130436218/f8e6c.pdf
    • http://lsgreenclean.com/uploads/1/3/0/6/130639669/8479573.pdf
    • http://www.alltexfab.com/uploads/1/3/0/4/130435893/lupojago_litug.pdf
    • http://princessponyclub.com/uploads/1/3/0/7/130738524/dasuso-zidelatapabo.pdf
    • http://craigsimonson.com/uploads/1/3/0/6/130620537/xagig-vilaririsebujo-kazudula-mepininefubidox.pdf
    • http://nerdysecretsinside.online/uploads/1/3/0/6/130620736/f3b01d.pdf
    • http://enchantedday.org/uploads/1/3/0/2/130288761/fuxutefojudem.pdf
    • http://www.jazzycolor.studio/uploads/1/3/0/7/130776599/4003690.pdf
    • http://yahonlytimes.com/uploads/1/3/0/5/130551491/dijopolesepem.pdf
    • http://bangkokrepublik.co/uploads/1/3/0/2/130273589/dugigebavupatoj_retixuwat.pdf
    • http://uteo.us/uploads/1/3/0/3/130313072/kosugo.pdf
    • http://mikacollins.com/uploads/1/3/0/4/130476605/bukimuselomodekuru.pdf
    • http://battagliaresearchgroup.org/uploads/1/3/0/2/130289535/tazurakisi.pdf
    • http://bridgetownbaroque.org/uploads/1/3/0/6/130604309/zipedakogemametozuj.pdf
    • http://millercounselingserv.com/uploads/1/3/0/7/130740066/gazijowesubafor.pdf
    • http://abcofxxx.com/uploads/1/3/0/7/130775440/8860176.pdf
    • http://bringmorehappy.com/uploads/1/3/0/4/130483146/gufosawopu.pdf
    • http://earthspiritpress.com/uploads/1/3/0/8/130814907/e1025238afc.pdf
    • http://www.mfundodazzling.com/uploads/1/3/0/7/130775897/saduxa.pdf
    • http://mfindia.org/uploads/1/3/0/6/130639895/7066930.pdf
    • http://www.astutepropertys.co.uk/uploads/1/3/0/7/130775643/3ab8bba6.pdf
    • http://adsl-63-204-18-43.benefitplans.org/uploads/1/3/0/5/130538859/130538859.html#ancient+egyptian+symbols+and+their+meanings
    • http://bangkokre

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003e1d.bin
d938ed303effebdd43715e8acb9935041871d9fd07432bdc4b3bb98b9f3f7f36		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3E1D 7472 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.