Malicious PDF — malware analysis report

Static analysis result for SHA-256 5a623a928651b011…

MALICIOUS

PDF

32.8 KB Authoring application: Smallpdf Desktop
MD5: 7e4ffe23a9a1f52436b76bac9b39582f SHA-1: 7c1ed65b29e16e74a41b25e17c4eb81b8cde51fc SHA-256: 5a623a928651b011c1ba87dee6b6d24170e03e7bdfb44be161fd60ed859e6da9
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded URLs pointing to external PDF files, a technique often used for SEO spam or to distribute malicious content. The ClamAV detection and ML classifier strongly indicate malicious intent, specifically identified as 'Pdf.Phishing.TtraffRobotInstall-7605656-0'. While no scripts were explicitly extracted, the PDF structure and embedded URLs suggest an attempt to redirect the user to potentially harmful content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://webmail.bigfatsmile.io/uploads/1/3/0/2/130289277/5711658.pdf
    • http://www.jheremytoledo.com/uploads/1/3/0/6/130621684/7120114.pdf
    • http://whitecleanoxfordlimited.com/uploads/1/3/0/5/130540037/fovunebotoxe_nogifuzar_puvutopan.pdf
    • http://www.meagnsarmardin.com/uploads/1/3/0/6/130639835/2561605.pdf
    • http://townhousemarketinggroup.com/uploads/1/3/0/6/130639751/mejosezaxebake.pdf
    • http://thedownsideofbliss.com/uploads/1/3/0/6/130621337/8ff1376.pdf
    • http://christopherjordanclothingco.com/uploads/1/3/0/6/130640163/9983688.pdf
    • http://www.rawfoodcapsules.eu/uploads/1/3/0/2/130287261/7243695.pdf
    • http://usagaslogs.com/uploads/1/3/0/3/130379447/gezetof.pdf
    • http://redeyeapparel.com/uploads/1/3/0/7/130740318/radaromexejisazaxu.pdf
    • http://aclassofyourown.com/uploads/1/3/0/7/130776381/3876514.pdf
    • http://hometrgbuild.com/uploads/1/3/0/4/130435938/d9b666c2083.pdf
    • http://simplynature-fineartphotography.com/uploads/1/3/0/5/130544754/pixegawojerame_pifimukijetexis.pdf
    • http://www.englishwithelspeth.com/uploads/1/3/0/6/130639553/7184151.pdf
    • http://vpstestsite.com/uploads/1/3/0/6/130604150/sabuzivomar.pdf
    • http://lifted-queens.com/uploads/1/3/0/4/130436108/130436108.html#hotel+california+guitar+lesson+365

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001bda.bin
83459e82cebe561b9e65dda6a09953c9e35f75e5df0fa62a624e1833cc5b8086		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1BDA 1708 bytes
font_01_sfnt_off0000269e.bin
d361d319c233bfdb230ae0cb52b7d1bbe438a7a70c153fe2aafc5c38f5a8a758		 pdf-font-stream PDF embedded font (sfnt) at offset 0x269E 7112 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.