Malicious PDF — malware analysis report

Static analysis result for SHA-256 52c95183807e3a38…

MALICIOUS

PDF

97.2 KB Authoring application: PDFBox
MD5: 23d9e42a650317faa32400c735e618b5 SHA-1: 344561bc49e128af8cf473b2f66cf06d68424a18 SHA-256: 52c95183807e3a38e86f71a7f31920a06967ca781cf85999035d474a17067f8e
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF was flagged by multiple heuristics, including a critical ClamAV detection for 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and a PDF link farm detection. The document body contains numerous embedded URLs pointing to external PDF files hosted on various domains. This indicates a likely phishing or traffic redirection scheme, aiming to lure users to malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://oliviaiannotti.com/uploads/1/3/0/5/130539251/logiwaworamoseru.pdf
    • http://aldenmoves.com/uploads/1/3/0/4/130436482/e7bcf9.pdf
    • http://tezifiji.indmovieonline.club/uploads/2020/01/28/262621.pdf
    • http://vafewek.onlycamp10.com/uploads/2020/01/28/timutup.pdf
    • http://bejustalittlebetter.com/uploads/1/3/0/6/130620868/jivosove.pdf
    • http://life9rescue.org/uploads/1/3/0/4/130476035/20214bb4.pdf
    • http://mirigos.tvori-shedevr.ru/uploads/2020/01/29/jadelizibutid-feripog-zujevirovomu.pdf
    • http://blueegg.net/uploads/1/3/0/2/130288751/a0ccb5114aa1.pdf
    • http://maisfutebol.online/uploads/2020/01/27/3847327.pdf
    • http://mohamed-albarasi-academy.com/uploads/1/3/0/6/130622104/130622104.html#bulkhead+transformers+g1

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000012df.bin
3748f9ae8f005f45c55583229479b8beb35a3792c9072cca200b72a528ca4845		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12DF 8056 bytes
font_01_sfnt_off00014559.bin
87fd6b1a35a64f5c2d30902eea89631a9c05d6b36ef70c6d0cee4d2ad867525e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x14559 2596 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.